Taxonomy
ZeroDayRAT vs Stalkerware
Categories are not severity rankings. They describe who deploys the software, how it arrives and what it is optimised for — each of which changes the appropriate response.
Quick Answer
How is ZeroDayRAT different from stalkerware?
Stalkerware is consumer monitoring software typically installed by someone with physical access to the victim’s device, often marketed openly. ZeroDayRAT has been documented as a commercially marketed remote-access and surveillance platform with a broader reported capability set and an operator console. The categories overlap in effect — covert surveillance of a person — but differ in distribution, technical depth and typical deployment context.
Mobile surveillance threat taxonomy
| Category | Definition | Typical purpose | Distinguishing characteristic |
|---|---|---|---|
| Stalkerware | Consumer monitoring software, usually installed with physical device access by someone known to the victim. | Interpersonal surveillance and control. | Often marketed openly as "parental" or "employee" monitoring. |
| RAT | Malware granting an operator remote control and surveillance of a device. | Flexible: espionage, fraud, harassment. | Defined by remote administration, not by who buys it. |
| Banking trojan | Malware specialised in financial credential theft and transaction manipulation. | Direct financial gain. | Narrow, monetisation-focused feature set. |
| Commercial spyware | Surveillance capability productised and sold to multiple buyers. | Varies by buyer. | Dashboards, documentation, per-operator infrastructure. |
| Mercenary spyware | High-capability surveillance associated with licensed, often government-linked customers. | Targeted intelligence collection. | Documented exploit chains; extensive forensic research record. |
| ZeroDayRAT | A commercially marketed mobile RAT and surveillance platform documented from February 2026. | Reported broad surveillance and financial targeting. | Commercial marketing; no confirmed zero-day or zero-click chain. |
Why Taxonomy Beats Comparison
Ranking these categories by how frightening they sound produces poor decisions. A stalkerware case may carry higher immediate physical-safety risk than a commodity RAT infection, because the perpetrator is usually physically present in the victim’s life. A banking trojan may cause faster financial loss than a comprehensive surveillance platform. Category should therefore inform response design, not headline severity.
Join Our Community
ZeroDayRAT Intelligence on Telegram
Get real-time mobile spyware alerts, threat briefings, and defensive guidance.
Response Differences by Category
- Stalkerware: prioritise personal safety planning before removal, since removal may be detected by the perpetrator.
- RAT / commercial spyware: prioritise identity containment and session revocation alongside device work.
- Banking trojan: prioritise financial institution contact and transaction review.
- Mercenary spyware: prioritise preservation, specialist forensics and hardened-mode replacement devices.
- All categories: reset credentials from a separate known-clean device.
Where Categories Overlap
Overlap is the norm, not the exception. A commercially marketed platform can be used for interpersonal surveillance, making it functionally stalkerware in that instance. A RAT with clipboard and OTP functionality performs the work of a banking trojan. Classify by observed behaviour in the specific case, and let the category guide the playbook rather than define the truth.
Evidence & Sources
ZeroDayRAT reporting summarised here draws on public cybersecurity research and CERT-style reporting from February 2026 onward. We distinguish independently observed technical evidence from media reporting, operator claims and our own analytical assessment. Primary sources are linked so readers can verify claims directly.
- iVerify — ZeroDayRAT research — mobile security research, February 2026
- SecurityWeek — ZeroDayRAT coverage — cybersecurity media, February 2026
- BleepingComputer — mobile spyware reporting — cybersecurity media
- ThaiCERT — advisory on reported functionality — CERT advisory, February 2026
- Dark Reading — commercial spyware analysis — cybersecurity media, February 2026
- Cyberthint — seller-demo & HUMINT analysis — threat intelligence/HUMINT, February 2026
- The Hacker News — builder/panel architecture — secondary security press, February 2026
- ESET forum — vendor IOC inquiry — vendor staff statement, February 2026
- Coalition Against Stalkerware — definitions and victim-safety guidance — stalkerware victim support
- MITRE ATT&CK Mobile — behavioural framing across malware categories.
Source verification policy: see Editorial Policy
Support This Publisher