Terminology Reference
Zero-Day vs Zero-Click vs RAT
Three terms that are routinely used as synonyms and describe entirely different things. Getting them right changes which defences you prioritise.
Quick Answer
Is ZeroDayRAT really a zero-day?
There is currently no sufficient public technical evidence to conclude that ZeroDayRAT itself depends on a genuine previously unknown vulnerability. A RAT is not automatically a zero-day, a zero-day is not automatically zero-click, and a zero-click exploit is not automatically spyware. Product naming is marketing; technical classification requires evidence.
Mobile threat terminology — comparison
| Term | Definition | Requires user interaction? | Describes vulnerability or malware? |
|---|---|---|---|
| Zero-day | A vulnerability unknown to or unpatched by the responsible vendor when exploitation begins. | Depends on the exploit — a zero-day may be one-click or zero-click. | Vulnerability |
| Zero-click | An attack requiring no deliberate user interaction such as tapping a link or opening an attachment. | No | Attack characteristic |
| One-click | An attack requiring a single user action, typically opening a link or file. | Yes | Attack characteristic |
| RAT | Malware providing an operator with remote control and surveillance of a device. | Depends on delivery | Malware |
| Spyware | Malware whose purpose is covert observation of a person or device. | Depends on delivery | Malware |
| Exploit | Code or input that abuses a specific vulnerability to change program behaviour. | Depends | Technique against a vulnerability |
| Exploit chain | Several exploits combined to move from initial reach to durable, privileged access. | Depends | Technique sequence |
| Payload | The component delivered and executed after initial access is obtained. | No | Malware component |
| C2 (command and control) | Infrastructure through which an operator tasks malware and receives data. | No | Infrastructure |
| Persistence | Mechanisms that keep access available across reboots, updates or app restarts. | No | Malware behaviour |
| Privilege escalation | Gaining rights beyond those initially granted to the code. | No | Technique |
| Sandbox escape | Breaking out of the isolation boundary the platform applies to an application. | No | Technique |
| Remote code execution | Causing code of the attacker’s choosing to run on a remote system. | Depends | Technique / vulnerability impact |
Why the Distinction Matters Operationally
Terminology decides where budget goes. If a team believes it faces a zero-click zero-day, it will focus on patch velocity, hardened modes and exploit-mitigation features. If the realistic threat is a user-installed application that requests powerful permissions, the higher-yield controls are app-provenance policy, permission hunting, user education and identity hardening. Both programmes are legitimate; applying the wrong one leaves the actual entry path uncovered.
- A RAT is not automatically a zero-day — most RATs rely on persuasion, not vulnerabilities.
- A zero-day is not automatically zero-click — many require the target to open something.
- A zero-click exploit is not automatically spyware — it is a delivery characteristic, not a payload.
- Spyware can be installed through social engineering without any zero-day involved.
Is ZeroDayRAT Really a Zero-Day?
Public reporting has discussed an “exploit” function visible in material associated with the platform. A labelled button in an operator interface establishes that the seller advertises exploitation; it does not establish that a working, previously unknown vulnerability exists behind it. Independent researchers have not publicly confirmed a genuine ZeroDayRAT zero-day exploit chain.
Evidence Classification
Join Our Community
ZeroDayRAT Intelligence on Telegram
Get real-time mobile spyware alerts, threat briefings, and defensive guidance.
Is ZeroDayRAT Zero-Click?
There is an important difference between what has been reported about delivery and what has been claimed about it. Reporting has centred on user-involved installation — a target is persuaded to install or approve something. Zero-click claims, by contrast, describe interaction-free compromise, which requires a reachable parsing surface, a memory-safety or logic failure, usually a sandbox escape, and reliable delivery. Each of those is independently difficult, and their combination is what makes genuine zero-click chains rare and expensive.
Absent independent technical demonstration, a zero-click ZeroDayRAT chain should be recorded as unconfirmed. That is not a claim that it is impossible; it is a statement about the current evidence.
How to Read Capability Claims
- Ask what was observed, by whom, and on what device and OS version.
- Ask whether the claim comes from a researcher, a vendor, a seller or a reseller advertisement.
- Ask whether a demonstration involved a real, updated device or a permissive test configuration.
- Ask whether the described behaviour requires permissions a user must grant.
- Record the answer as observed, reported, advertised or unconfirmed — and revisit it when new evidence appears.
Evidence & Sources
ZeroDayRAT reporting summarised here draws on public cybersecurity research and CERT-style reporting from February 2026 onward. We distinguish independently observed technical evidence from media reporting, operator claims and our own analytical assessment. Primary sources are linked so readers can verify claims directly.
- iVerify — ZeroDayRAT research — mobile security research, February 2026
- SecurityWeek — ZeroDayRAT coverage — cybersecurity media, February 2026
- BleepingComputer — mobile spyware reporting — cybersecurity media
- ThaiCERT — advisory on reported functionality — CERT advisory, February 2026
- Dark Reading — commercial spyware analysis — cybersecurity media, February 2026
- Cyberthint — seller-demo & HUMINT analysis — threat intelligence/HUMINT, February 2026
- The Hacker News — builder/panel architecture — secondary security press, February 2026
- ESET forum — vendor IOC inquiry — vendor staff statement, February 2026
- MITRE ATT&CK Mobile knowledge base — technique framing and terminology.
- Apple Platform Security documentation — sandboxing, code signing, Lockdown Mode.
- Android Security documentation — permissions, Play Protect, sideloading behaviour.
Source verification policy: see Editorial Policy
Support This Publisher