Skip to content
ZeroDayRATIntelligence Center
Full Tech ZeroDayRat ₿ 0.10 BTC

Chronology

ZeroDayRAT Intelligence Timeline

Every entry carries a date, a source and an evidence classification. Entries are added only when a verifiable public development occurs.

ReportedLast reviewed: 2026-08-31By Daniel Voss, Lead Threat Researcher

Quick Answer

When was ZeroDayRAT first reported?

ZeroDayRAT entered public cybersecurity reporting in February 2026, first through mobile security research and then through broader cybersecurity media and CERT-style advisories within the same month. The public record is therefore recent, and the intelligence picture should be expected to change as independent verification accumulates.

Download: ZeroDayRAT Malware Intelligence Dossier (PDF)Crygma / Encrygma OSINT synthesis, cut-off 6 October 2026 — chronology, capability breakdown, peer comparison and confidence assessment.

  1. February 2, 2026

    Earliest documented appearance of the brand and market operation

    Seller activity begins on Telegram. The brand, sales operation, and operator panel are documented from this point forward.

    ReportedSource: iVerify — primary discovery/research

  2. February 10, 2026

    iVerify publishes first substantial public breakdown

    ZeroDayRAT is described publicly as a commercially marketed mobile remote-access and surveillance platform, with a browser-based operator panel and a broad reported collection feature set. Android 5–16 and iOS through version 26 are claimed.

    ReportedSource: iVerify — primary discovery/research

  3. February 11, 2026

    ESET forum staff state no IOC could be found

    An ESET administrator reports that ESET could not determine product detection for ZeroDayRAT because it could not find an IOC. This underscores the absence of an authenticated public sample.

    UnconfirmedSource: ESET forum — vendor staff statement

  4. February 12, 2026

    Cisco Talos weekly roundup references ZeroDayRAT reporting

    Cisco awareness expands, but the item is a news roundup rather than Talos sample reverse engineering.

    ReportedSource: Cisco Talos roundup — vendor news roundup

  5. February 16, 2026

    The Hacker News reports buyer builder and self-hosted panel architecture

    Secondary-source reporting adds that buyers receive a builder and can deploy the panel on their own server. The builder and panel package have not been independently published for examination.

    ReportedSource: The Hacker News — secondary security press

  6. February 18, 2026

    Cyberthint publishes seller-contact and demo analysis

    Underground-market investigation observes a shortened URL (2cm.es/1oDIZ) redirecting to mhko78-gui.github.io. Cyberthint identifies credibility problems in seller screenshots and raises the possibility that the platform is overhyped or partly fraudulent.

    ReportedSource: Cyberthint — threat intelligence/HUMINT

  7. February 2026

    Broader cybersecurity media and CERT reporting

    Coverage expands, summarising advertised capabilities including device profiling, location, SMS and notification access, media surveillance, input capture and financial targeting, while noting that several claims remain independently unverified.

    ReportedSource: SecurityWeek, ThaiCERT, Dark Reading and comparable publications

  8. February 2026

    Zero-day and zero-click claims examined

    An “exploit” function is discussed in material associated with the platform, but no independent technical confirmation of a genuine zero-day or a demonstrated zero-click infection chain is published. The product name does not constitute evidence of a zero-day vulnerability.

    UnconfirmedSource: Analytical review of public reporting

  9. May 27, 2026

    Scholarly survey of covert mobile RATs includes ZeroDayRAT

    An academic survey places ZeroDayRAT in the broader landscape of covert mobile remote-access tools, confirming sustained research community attention.

    ReportedSource: Academic publication — scholarly survey

  10. August 31, 2026

    Technical Threat Intelligence and Defensive Engineering Report published

    A comprehensive technical report synthesises all public evidence into a confidence assessment, IOC table, detection rules (YARA, Snort, Sigma, Splunk, KQL), hunting strategies, and an incident response workflow. Published on this site at /technical-report.

    Analytical AssessmentSource: ZeroDayRAT Intelligence Center — this site
Professional Spy Phones — Zero-Click Spyware for authorized investigative and cyber intelligence operations

Join Our Community

ZeroDayRAT Intelligence on Telegram

Get real-time mobile spyware alerts, threat briefings, and defensive guidance.

Join the Channel

Timeline Policy

We do not invent historical events, infer dates from context, or list developments we cannot attribute to a public source. Future verified developments will be added with the same date, source and evidence fields, and material changes will be reflected on the affected analysis pages.

Update Cadence — Weekly

This timeline is reviewed every week. When no new verified public developments have occurred, the "Last reviewed" date above is still refreshed to signal that the page is actively maintained, not abandoned. If you are aware of a public development we have not listed, submit it via the contact page.

Evidence & Sources

ZeroDayRAT reporting summarised here draws on public cybersecurity research and CERT-style reporting from February 2026 onward. We distinguish independently observed technical evidence from media reporting, operator claims and our own analytical assessment. Primary sources are linked so readers can verify claims directly.

Source verification policy: see Editorial Policy

Support This Publisher

Related Intelligence

Evidence Classification Legend

Observed
Directly observed in independent analysis or testing.
Confirmed
Independently verified by multiple sources with technical evidence.
Reported
Reported by credible security researchers but not fully independently verified.
Advertised / Claimed
Claimed by the seller or operator; not independently verified.
Unconfirmed
Cannot be confirmed or denied based on available public evidence.
Analytical Assessment
Analytical conclusion based on reasoning from available evidence.
Contact us on Telegram