Comparative Analysis
ZeroDayRAT vs Pegasus
These two names appear together in headlines far more often than the evidence justifies. This comparison exists specifically to prevent false equivalence.
Quick Answer
Is ZeroDayRAT like Pegasus?
They are not technically equivalent on current public evidence. Pegasus is associated with highly sophisticated commercial surveillance operations and documented exploit chains, including publicly documented zero-click delivery. ZeroDayRAT has been publicly discussed as a commercially marketed RAT and spyware platform, with no public confirmation of a zero-day or zero-click chain. The shared category — commercial mobile spyware — does not imply shared sophistication.
Comparison — UNKNOWN is a valid value where public evidence is absent
| Dimension | Pegasus | ZeroDayRAT |
|---|---|---|
| Known history | Extensively documented over many years by multiple independent research organisations. | Publicly documented from February 2026; the research record is early and thin. |
| Target market | Associated with government-linked customers under a licensed sales model. | Marketed commercially; the buyer population appears broader and less constrained. |
| Delivery evidence | Multiple independently documented delivery methods across years of casework. | Reporting has centred on user-involved installation. |
| Zero-click evidence | Zero-click chains have been documented publicly by independent researchers. | No public confirmation. |
| Exploit evidence | Documented exploit chains, including vendor-acknowledged vulnerabilities. | Unconfirmed; an "exploit" function has been discussed but not independently verified. |
| Surveillance capabilities | Comprehensive device surveillance documented in forensic casework. | Broad capability set reported and advertised; independent validation varies by feature. |
| Infrastructure model | Studied and clustered extensively across many years. | Per-operator infrastructure; little public clustering to date. |
| Public attribution | Attributed to a named vendor with substantial public record. | UNKNOWN — platform authorship and operator identities are not publicly established. |
| Research maturity | High: forensic methodologies and indicators are well established. | Low: methodologies for reliable identification are still forming. |
Why the Comparison Is Made at All
Pegasus is the reference point most non-specialists have for mobile spyware, so new platforms are described by analogy to it. That analogy is useful for conveying consequence — a compromised phone is severe — and misleading for conveying capability, because it implies exploitation sophistication that current ZeroDayRAT evidence does not support.
Join Our Community
ZeroDayRAT Intelligence on Telegram
Get real-time mobile spyware alerts, threat briefings, and defensive guidance.
The Differences That Matter Defensively
- If a threat relies on user-involved installation, app-provenance policy and user education are effective.
- If a threat relies on interaction-free exploitation, patch velocity and hardened modes matter far more.
- Confusing the two leads organisations to buy the wrong controls for their actual exposure.
- For high-risk individuals, both programmes are warranted — hardened modes plus strict app policy.
Statement of Position
How This Page Will Change
If independent researchers publish technical evidence of a ZeroDayRAT exploit chain or a demonstrated zero-click delivery path, the relevant rows will be updated, the evidence classification changed and the change recorded on the intelligence timeline. Until then, the table stands as written.
Evidence & Sources
ZeroDayRAT reporting summarised here draws on public cybersecurity research and CERT-style reporting from February 2026 onward. We distinguish independently observed technical evidence from media reporting, operator claims and our own analytical assessment. Primary sources are linked so readers can verify claims directly.
- iVerify — ZeroDayRAT research — mobile security research, February 2026
- SecurityWeek — ZeroDayRAT coverage — cybersecurity media, February 2026
- BleepingComputer — mobile spyware reporting — cybersecurity media
- ThaiCERT — advisory on reported functionality — CERT advisory, February 2026
- Dark Reading — commercial spyware analysis — cybersecurity media, February 2026
- Cyberthint — seller-demo & HUMINT analysis — threat intelligence/HUMINT, February 2026
- The Hacker News — builder/panel architecture — secondary security press, February 2026
- ESET forum — vendor IOC inquiry — vendor staff statement, February 2026
- Published forensic research on mercenary spyware from independent research organisations (multi-year record).
- Apple Platform Security documentation — Lockdown Mode and targeted-attack notifications.
Source verification policy: see Editorial Policy
Support This Publisher