ZeroDayRAT: Technical Threat Intelligence and Defensive Engineering Report

Executive Summary

iVerify publicly disclosed ZeroDayRAT on February 10, 2026, after observing activity beginning February 2. Its research showed a browser-based operator panel advertised through Telegram and claimed support for Android 5–16 and iOS through version 26. Operators were shown device metadata, SMS, notifications, location, accounts, camera/microphone feeds, screen activity, keystrokes, cryptocurrency-related functions, and banking/payment theft functions. Infection was described as requiring an Android APK or an unspecified iOS "payload," normally delivered through smishing, phishing, fake app stores, or messaging links.

The most important analytical qualification is that the public reporting does not contain a reproducible reverse engineering of an authenticated ZeroDayRAT implant. There is no verified public SHA-256 tied to an Android APK or iOS payload, no package or bundle identifier, no decoded configuration, no independently demonstrated command-and-control protocol, no encryption algorithm or key exchange, no persistence implementation, no exploit chain, and no published evidence of privilege escalation, root/jailbreak exploitation, packing, or anti-analysis code. An ESET administrator similarly reported on February 11 that ESET could not determine product detection because it could not find an IOC.

Cyberthint subsequently performed underground-market/HUMINT work and reviewed a seller demonstration. It observed a shortened URL, 2cm.es/1oDIZ, redirecting toward mhko78-gui.github.io, and obtained pricing and an asserted XSS Forum escrow option. At the same time, Cyberthint identified serious credibility problems in seller-provided screenshots, including what appeared to be a wallet-address creation page and apparently static/demo data, and explicitly raised the possibility that the platform was overhyped or partly fraudulent.

This limitation is especially consequential for the iOS claims. Apple documents that ordinary third-party iOS applications are sandboxed, are constrained by signed entitlements, cannot arbitrarily read other applications' data, and cannot use normal APIs simply to escalate their privileges. Therefore, ZeroDayRAT's claimed cross-application keylogging, unrestricted account enumeration, background surveillance, and broad payment-app interception on a fully patched modern iPhone would require an additional enabling mechanism not disclosed in public ZeroDayRAT research — for example an exploit chain, unusually privileged provisioning/entitlements, an MDM-related path, or another compromise condition.

Confidence Assessment

Every proposition about ZeroDayRAT carries a different level of evidentiary support. The table below records the confidence level and analytical judgment for each major claim.

Malware Overview, Attribution & Campaigns

iVerify introduced ZeroDayRAT as a mobile spyware platform sold openly through Telegram, with dedicated sales, support, and update channels and a browser-facing control panel. The published panel imagery represents Android and iOS as supported platforms and advertises device profiling, surveillance, account and communications access, and financial-theft capabilities. The Hacker News later reported, based on the same research ecosystem, that buyers receive a builder and can deploy the panel on their own server; because no builder or panel package has been independently published for examination, that architectural detail should be treated as secondary-source reporting, not verified reverse engineering.

The term "RAT" is somewhat imprecise here. The advertised system combines functions normally associated with remote-access trojans, stalkerware, credential stealers, mobile banking trojans, and commercial spyware. The panel reportedly provides device telemetry and operator-initiated surveillance, while specialized functions target SMS OTPs, cryptocurrency wallets, clipboard contents, and payment applications.

Known campaigns are likewise unspecified. Public reporting describes methods that could be used for deployment — smishing, phishing email, fake application stores, WhatsApp, and Telegram links — but does not name a verified ZeroDayRAT intrusion against a specific organization or sector. The panel showed example devices in India and the United States, but those screenshots are not independently verified victim telemetry.

Market Profile and Peer Comparison

A separate OSINT synthesis (Crygma / Encrygma, cut-off 6 October 2026) adds commercial-model detail absent from the primary technical sources above. The seller advertises in five languages — English, Spanish, Portuguese, Russian, and Chinese — across dedicated Telegram sales, support, and update channels. Secondary reporting, attributed to iVerify researcher Daniel Kelley, puts the kit's price near $2,000; that figure does not appear in the primary iVerify blog and should be treated as an approximate quote, not a confirmed tariff. Kelley also told SecurityWeek that the operator posts in Chinese, uses a Russian-registered domain, and has targeted victims in India — a geographic and linguistic mismatch he assessed as likely deliberate noise intended to frustrate attribution, not as evidence of any specific actor's nationality.

Positioned against two other named mobile/desktop threats, ZeroDayRAT sits in the mid-tier commodity stalkerware market: priced well above low-end tools like Millenium RAT, but with no government licensing model, exploit subscription, or vendor-operated infrastructure of the kind seen in mercenary spyware such as Predator.

Timeline of Notable Reporting and Samples

Technical Analysis and Attack Chain

The table below records what is publicly supported for each technical dimension of the platform, and the assessment for each. Dimensions marked "Unknown" have no authenticated sample or published technical evidence.

The observed/demo attack chain from public reporting is: target receives a smishing/phishing message or link → user installs an Android APK or iOS "payload" from a non-official source → the implant requests high-risk permissions (Accessibility, SMS, notifications, overlay, location, camera, microphone) → the device appears in the operator's browser panel → the operator can initiate surveillance, collection, and financial-theft functions. No exploit chain or zero-click mechanism has been published.

Indicators of Compromise and Detection Engineering

Detection Rules

The following rules are heuristic hunting scaffolding. They are not ZeroDayRAT-specific signatures. Validate syntax and SID ranges against your deployed tools before production use.

rule Android_Mobile_Spyware_High_Risk_Capabilities_Triage
{
    meta:
        description = "Heuristic Android spyware/RAT capability triage; NOT ZeroDayRAT-specific"
        author = "OpenAI"
        date = "2026-08-31"
        confidence = "low"
        scope = "Decoded APK/JADX/apktool output; expect false positives"
    strings:
        $notif_svc    = "NotificationListenerService" ascii
        $media_proj   = "MediaProjectionManager" ascii
        $clipboard    = "ClipboardManager" ascii
        $accessibility = "AccessibilityService" ascii
        $sms_read     = "READ_SMS" ascii
        $sms_recv     = "RECEIVE_SMS" ascii
        $overlay      = "SYSTEM_ALERT_WINDOW" ascii
        $location     = "ACCESS_FINE_LOCATION" ascii
        $camera       = "CAMERA" ascii
        $mic          = "RECORD_AUDIO" ascii
    condition:
        6 of them
}

# TEMP ZeroDayRAT seller-demo shortened URL
alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"TEMP ZeroDayRAT seller-demo shortened URL";
    flow:to_server,established;
    http_host; content:"2cm.es",nocase;
    http_uri; content:"/1oDIZ";
    sid:9901011;
    rev:1;
)

# TEMP ZeroDayRAT seller-demo GitHub Pages hostname
alert tls $HOME_NET any -> $EXTERNAL_NET any (
    msg:"TEMP ZeroDayRAT seller-demo GitHub Pages hostname";
    flow:established,to_server;
    tls.sni; content:"mhko78-gui.github.io",nocase;
    sid:9901012;
    rev:1;
)

title: Suspicious Sideloaded Android Application With Spyware-Like Privileges
id: 42b08b25-85a4-4bf3-a7df-cbb802a4a8e8
status: experimental
description: >
  Heuristic hunt for sideloaded Android apps combining privileges frequently
  associated with mobile surveillance or credential theft.
  This is NOT a ZeroDayRAT-specific signature.
date: 2026-08-31

logsource:
  category: mobile_app_inventory
  product: android

detection:
  sideload:
    InstallSource|contains:
      - 'sideload'
      - 'unknown'
      - 'browser'
      - 'package_installer'

  surveillance_permissions:
    Permissions|contains|all:
      - 'android.permission.CAMERA'
      - 'android.permission.RECORD_AUDIO'

  collection_permissions:
    Permissions|contains:
      - 'android.permission.READ_SMS'
      - 'android.permission.RECEIVE_SMS'
      - 'android.permission.SYSTEM_ALERT_WINDOW'
      - 'android.permission.BIND_ACCESSIBILITY_SERVICE'

  condition: sideload and surveillance_permissions and collection_permissions

falsepositives:
  - Authorized remote support tools
  - Approved accessibility products
  - Enterprise device-management utilities

level: high

index=mobile sourcetype=mdm:app_inventory platform="Android"
| eval sideloaded=if(
    match(lower(install_source),
          "sideload|unknown|browser|package_installer"),
    1, 0)
| eval risky_permissions=mvfilter(
    match(permissions,
          "READ_SMS|RECEIVE_SMS|SYSTEM_ALERT_WINDOW|BIND_ACCESSIBILITY_SERVICE|RECORD_AUDIO|CAMERA|ACCESS_FINE_LOCATION")
  )
| eval risky_count=mvcount(risky_permissions)
| where sideloaded=1 AND risky_count>=4
| stats
    values(app_name) as apps
    values(package_id) as packages
    values(install_source) as install_sources
    values(risky_permissions) as risky_permissions
  by user device_id

(index=proxy OR index=dns OR index=firewall)
(
  url="*2cm.es/1oDIZ*"
  OR dest_domain="mhko78-gui.github.io"
  OR query="mhko78-gui.github.io"
)
| stats
    earliest(_time) as first_seen
    latest(_time) as last_seen
    values(url) as urls
    values(dest_ip) as destination_ips
  by user src device_id
| convert ctime(first_seen) ctime(last_seen)

event.dataset:"mobile.app_inventory" and
host.os.type:"android" and
mobile.app.install_source:(
  "sideload" or "unknown" or "browser" or "package_installer"
) and
mobile.app.permissions:(
  "android.permission.SYSTEM_ALERT_WINDOW" or
  "android.permission.READ_SMS" or
  "android.permission.RECEIVE_SMS" or
  "android.permission.BIND_ACCESSIBILITY_SERVICE"
) and
mobile.app.permissions:(
  "android.permission.CAMERA" or
  "android.permission.RECORD_AUDIO"
)

url.full:*2cm.es/1oDIZ* or
dns.question.name:"mhko78-gui.github.io" or
url.domain:"mhko78-gui.github.io"

Hunting Strategies and Platform-Specific Detection

Because useful family-specific static indicators are scarce, hunting should be behavior-first and provenance-first: identify unexpected application installation, high-risk permission combinations, abnormal provisioning, suspicious links, and account/session anomalies, then preserve the candidate binary before removing it.

Android Hunting

• Highest-value hunts are for applications that are both unusual/sideloaded and over-privileged.
• Investigate recently installed packages with combinations of SMS access, notification access, Accessibility Service enrolment, overlay permission, and location/camera/microphone grants.
• Check for apps requesting Accessibility Service that are not on an approved allow-list.
• Review notification listener services and default-SMS-app changes.
• Correlate with DNS/proxy telemetry for rare-domain resolution or beaconing patterns.

iOS Hunting

• Check for enterprise/developer certificates and provisioning profiles that should not be present on a personal device.
• Review MDM enrollment state — unexpected MDM is a high-priority finding.
• If the advertised full-compromise behavior is observed on a non-jailbroken, patched device, preserve evidence before wiping — that may indicate an exploitation or privileged-installation mechanism absent from current public reporting.
• Review app inventory for sideloaded IPA files and unusual bundle identifiers.

Live Response Commands

# Create a comprehensive Android bug report.
adb bugreport zerodayrat_case.zip

# Inventory packages, APK paths, installer information and UIDs.
adb shell pm list packages -f -i -U

# Record installed package/service details.
adb shell dumpsys package > packages.txt

# Review enabled Accessibility Services.
adb shell settings get secure enabled_accessibility_services

# Review enabled notification listeners.
adb shell settings get secure enabled_notification_listeners

# Capture scheduled jobs and battery-related execution artifacts.
adb shell dumpsys jobscheduler > jobscheduler.txt
adb shell dumpsys batterystats > batterystats.txt

# Preserve currently available logcat.
adb logcat -d -v threadtime > logcat.txt

# Work on a forensic copy/decrypted backup, not the sole evidence copy.
mvt-ios check-backup --output mvt_out /cases/device/decrypted_backup

# When a validated STIX2 IOC package becomes available:
mvt-ios check-backup \
  --iocs zerodayrat_validated_iocs.stix2 \
  --output mvt_out \
  /cases/device/decrypted_backup

# Windows
Get-ChildItem "$env:USERPROFILE" -Recurse -ErrorAction SilentlyContinue -Include *.apk,*.ipa | Get-FileHash -Algorithm SHA256

# Linux
find "$HOME" -type f \( -iname '*.apk' -o -iname '*.ipa' \) -print0 \
  | xargs -0 sha256sum

# macOS
find "$HOME" -type f \( -iname '*.apk' -o -iname '*.ipa' \) -print0 \
  | xargs -0 shasum -a 256

Incident Response, Mitigation, and Forensic Analysis

A suspected ZeroDayRAT incident should be treated first as mobile compromise plus possible identity compromise, not merely as an infected-file event. The advertised capabilities include SMS/OTP interception, account visibility, keylogging and financial manipulation, which means changing a password on the suspected device may simply expose the new credential to the attacker if the compromise is real.

Forensic Collection Priorities

Android: APKs and SHA-256s; package and installer name; application signing certificate; AndroidManifest.xml; services/receivers/providers; Accessibility configuration; notification listeners; overlay capability; runtime permissions; relevant logcat/bugreport material; scheduled jobs; app-specific network destinations from MTD/VPN/proxy telemetry; SMS containing the lure; browser download history; and enterprise identity telemetry around installation time.

iOS: full device metadata and OS build; an encrypted local backup where appropriate; application/bundle inventory; provisioning and configuration profiles; enterprise-app trust state; MDM configuration; browser history; suspicious Messages links; analytics/crash artifacts; network/MTD/DNS/VPN logs; and identity-provider events.

Static Android Analysis of an Acquired Sample

# Establish identity and preserve the original separately.
sha256sum suspect.apk
file suspect.apk
unzip -l suspect.apk

# Decode resources and manifest.
apktool d suspect.apk -o apktool_out

# Decompile DEX bytecode.
jadx -d jadx_out suspect.apk

# Hunt high-value capabilities and embedded infrastructure.
rg -n -i \
  'https?://|wss?://|socket|firebase|telegram|websocket|accessibility|\
SYSTEM_ALERT_WINDOW|READ_SMS|RECEIVE_SMS|RECORD_AUDIO|CAMERA|\
ACCESS_FINE_LOCATION|ClipboardManager|MediaProjection' jadx_out/