---
title: "Is ZeroDayRAT a Zero-Day or Zero-Click? (2026)"
description: "ZeroDayRAT's name implies a zero-day exploit, but public evidence doesn't confirm one. This guide explains the difference between zero-day, zero-click and RAT — and why the distinction changes your defenses."
evidence: "assessment"
last_updated: "2026-08-31"
author: "Daniel Voss, Lead Threat Researcher"
canonical: "https://zerodayrat.shop/zero-day-vs-zero-click-vs-rat"
---

# Zero-Day vs Zero-Click vs RAT

**Evidence classification: Analytical Assessment** — This terminology reference clarifies three terms that are routinely used as synonyms but describe entirely different things.

## Quick Answer

ZeroDayRAT's name implies a zero-day exploit, but public evidence does not confirm one. "Zero-day," "zero-click," and "RAT" describe different things. Getting them right changes which defenses you prioritize.

## Terminology

| Term | Definition | ZeroDayRAT? |
|------|-----------|-------------|
| **Zero-day** | A vulnerability exploited before the vendor has released a patch. | No public evidence |
| **Zero-click** | An exploit that requires no user interaction — the device is compromised with no action from the victim. | No public evidence |
| **One-click** | An exploit that requires the victim to take one action (tap a link, open a file). | Possible delivery method |
| **RAT** | Remote Access Trojan — software that gives an operator remote control and surveillance of a device. | Yes (by definition) |
| **Spyware** | Software that covertly monitors and collects information from a device. | Yes |
| **Exploit chain** | A sequence of vulnerabilities exploited in sequence to achieve a goal (e.g., full device access). | No public evidence |
| **C2** | Command and control — the infrastructure through which an operator sends instructions and receives data. | Yes (per-operator) |

## Why the Name Is Not Evidence

The name "ZeroDayRAT" is a **marketing label**, not a technical classification:

- **No public demonstration** of a ZeroDayRAT zero-day exploit exists.
- **No public demonstration** of a ZeroDayRAT zero-click infection chain exists.
- The name uses "zero-day" as a marketing term to imply sophistication, not as a verified technical characteristic.

A genuine zero-day exploit is a specific, valuable, and rare technical artifact. Calling a RAT "ZeroDayRAT" does not make it one.

## Why the Distinction Matters for Defense

| If the threat is... | You prioritize... |
|---------------------|-------------------|
| Zero-day / zero-click | Patch management, Lockdown Mode (iOS), exploit mitigation, network detection |
| RAT (social engineering) | Permission auditing, app review, user training, sideload prevention |
| Stalkerware | Physical device audit, accessibility service review, intimate partner safety |

ZeroDayRAT's reported delivery model (social engineering, sideloading, permission abuse) means **RAT defenses** are more relevant than zero-day defenses. Prioritize:
- Blocking sideloaded apps (MDM policy)
- Auditing accessibility and notification permissions
- User training on social engineering
- Mobile Threat Defense (MTD) solutions

## FAQ

### Is ZeroDayRAT really a zero-day?

No. The name implies it, but there is no public evidence of a zero-day exploit. Reported delivery relies on social engineering and permission abuse, not exploit chains.

### What's the difference between zero-day and zero-click?

A zero-day is a vulnerability (the vendor hasn't patched it yet). A zero-click is a delivery method (no user interaction needed). A zero-click exploit often uses a zero-day vulnerability, but they are different concepts. You can have a zero-day that requires one click, and a zero-click that uses a patched vulnerability.

### Why does this matter?

Because the defense strategy is different. Zero-day/zero-click threats require patch management and exploit mitigation. RAT threats require permission auditing and user training. Confusing them leads to deploying the wrong defenses.

## Sources

- [iVerify](https://iverify.com) — ZeroDayRAT mobile research reporting
- [SecurityWeek](https://securityweek.com) — coverage of advertised platform functionality
- [BleepingComputer](https://bleepingcomputer.com) — technical analysis reporting
- [ThaiCERT](https://thaicert.or.th) — advisory summarising reported functionality
- [Dark Reading](https://darkreading.com) — threat landscape analysis