What Is ZeroDayRAT?

Capability-to-Permission Mapping

Press coverage lists what ZeroDayRAT can reportedly do. The table below goes further: it maps each reported capability to the specific Android permission or API surface it would require, and to the iOS platform constraint that limits or prevents it. For defenders, this is the bridge between a threat report and an actionable MDM policy or permission audit. If your fleet enforces the Android permissions in the right-hand column, the corresponding capability is materially harder to exercise regardless of which operator deploys the tool.

Evidence Confidence Matrix

Not every reported ZeroDayRAT capability rests on the same quality of evidence. Some have been independently observed by researchers; others appear only in operator-facing marketing material. The matrix below separates what is observed from what is claimed, so defenders can calibrate investment — spending on exploit-mitigation for an unconfirmed zero-day claim is very different from spending on permission controls for a reported capability.

Where ZeroDayRAT Sits: The Spyware Commoditization Spectrum

ZeroDayRAT is often described as “spyware,” but that label alone does not tell defenders where to invest. The proprietary model below positions commercial mobile surveillance tools on a spectrum from bespoke nation-state implants to consumer stalkerware, scored by operator barrier, detection posture, and infrastructure model. ZeroDayRAT occupies Tier 2 — commoditized malware-as-a-service — which is precisely why the standard Pegasus playbook (specialized hunting, government disclosure, advanced mobile threat detection) does not transfer. Tier 2 threats are defeated by permission governance, MDM policy, and behavioral correlation, not by exploit-mitigation tooling.

ZeroDayRAT Definition

“ZeroDayRAT is the name used for a commercially marketed mobile remote-access and surveillance platform publicly documented by security researchers in 2026.”

Expanding on that definition: ZeroDayRAT (also written ZerodayRAT or Zero Day RAT) refers to a software offering rather than a single malware sample. Public reporting describes a package consisting of a mobile component that runs on a target device and a management interface through which an operator issues instructions and reviews collected information. This is the classic structure of a remote-access trojan, differentiated mainly by how it is sold and how accessible it is to non-specialist buyers.

The distinction between a “platform” and a “sample” matters for defenders. Because ZeroDayRAT is marketed to multiple buyers, each operator may run separate infrastructure, choose different delivery pretexts and enable different subsets of functionality. Consequently, indicators from one incident may have limited value in another, and detection strategies that depend on a fixed domain list or a single file hash will age badly.

When Was ZeroDayRAT Discovered?

ZeroDayRAT entered public cybersecurity discussion in February 2026. Initial identification and reporting was followed within the same month by broader coverage in established cybersecurity media and CERT-style advisories that summarised the reported capability set and the commercial marketing around it.

Because the public record is recent, the intelligence picture is necessarily incomplete. Some functionality has been described from marketing material and operator-facing interfaces rather than from independent technical validation on real devices. We therefore label each capability with an evidence classification rather than presenting a single flat feature list.

Why Security Researchers Are Paying Attention

The interest in ZeroDayRAT is less about novel exploitation and more about accessibility. Historically, comprehensive mobile surveillance required either bespoke development or the budget to procure a specialist surveillance product. When comparable functionality is packaged with a dashboard, documentation and support channels, the population of people capable of running a mobile surveillance operation grows sharply.

• Lower technical barrier: operating a console is not the same skill as writing an implant.
• Wider operator base: fraud actors, harassment actors and opportunistic criminals, not only espionage actors.
• Fragmented infrastructure: many independent operators, weakening takedown-based mitigation.
• Faster iteration: a vendor updating one platform propagates changes to every operator at once.

Is ZeroDayRAT Malware?

Yes, under the standard security definition. Software installed on a device without the informed consent of that device’s user, for the purpose of covert collection or remote control, is malware. Commercial packaging, terms of service, or a claim that the product is intended for “monitoring” do not change the technical classification when the deployment is unauthorized.

Is ZeroDayRAT Spyware?

The reported functionality is surveillance functionality. Location collection, message and notification visibility, camera and microphone access, screen monitoring and input capture all serve the purpose of observing a person rather than damaging or ransoming data. That functional profile is what the term spyware describes, and it is why the appropriate defensive frame is surveillance risk rather than only data-loss risk.

Is ZeroDayRAT a RAT?

A remote-access trojan is malware that provides an operator with ongoing remote control of an affected device. Public reporting describes exactly that pattern for ZeroDayRAT: a console from which commands are issued and results retrieved. The presence of remote administration is significant because persistent access is worth more to an attacker than any single act of data theft — collection can be re-tasked as the target’s circumstances change.

Does ZeroDayRAT Use a Zero-Day?

Not publicly confirmed. Public reporting has discussed an “exploit” function visible in material associated with the platform, but independent researchers have not publicly confirmed a genuine ZeroDayRAT zero-day exploit chain. A label inside an operator interface is a claim, not a demonstration.

Is ZeroDayRAT Zero-Click?

No publicly demonstrated ZeroDayRAT zero-click infection chain should be treated as established fact without independent evidence. Zero-click exploitation is a demanding engineering achievement, typically requiring a reachable parsing surface, memory-safety failure, sandbox escape and reliable delivery. Public ZeroDayRAT reporting has centred on user-involved installation instead.

What Devices Does ZeroDayRAT Target?

Android has been the primary environment in public reporting, which is consistent with the platform’s openness to applications installed outside official distribution channels. iOS targeting has also been reported or advertised. Defenders should hold these two statements apart: claimed compatibility and independently demonstrated compatibility are not necessarily identical, and iOS’s sandboxing, code signing and entitlement model mean that Android techniques do not transfer automatically.

Who Is At Risk?

• Executives and board members whose devices hold strategic communications.
• Government officials and public-sector staff.
• Journalists, researchers and civil-society figures.
• Cybersecurity personnel, who are attractive as a route into their employer.
• Finance professionals with payment or treasury authority.
• Cryptocurrency users, where theft is immediate and irreversible.
• Corporate employees with mobile access to SSO, email and internal applications.
• High-value individuals subject to litigation, negotiation or harassment.
• Ordinary consumers exposed to malicious applications or social engineering.

Why Mobile Spyware Matters to Enterprises

A modern enterprise authenticates people, not offices. A phone typically holds or can approve the factors that gate corporate email, cloud consoles, chat platforms, CRM systems and VPN access. When the endpoint that approves authentication is itself observed, the assurance value of that approval falls sharply.

This is why mobile compromise should be triaged as an identity incident, not only a device incident. Session review, token revocation, MFA-method audit and mailbox-rule inspection are as important as anything done to the handset.

Key Takeaways

• ZeroDayRAT is a commercially marketed mobile spyware / RAT platform first publicly documented in February 2026.
• Reported capabilities cover device, location, messaging, notification, media, input and financial surveillance.
• No public technical evidence establishes a ZeroDayRAT zero-day or a demonstrated zero-click chain.
• Android is the primary reported environment; iOS targeting is reported or advertised but not independently demonstrated at scale.
• The most important defensive consequence is identity exposure following endpoint compromise.
• Detection should correlate device, identity, network and behavioural telemetry rather than rely on static indicators.