---
title: "ZeroDayRAT vs Stalkerware: Threat taxonomy (2026)"
description: "ZeroDayRAT sits between consumer stalkerware and mercenary spyware. This taxonomy maps the differences in capability, distribution, targeting, and evidence — and where ZeroDayRAT fits in the mobile threat landscape."
evidence: "assessment"
last_updated: "2026-08-31"
author: "Daniel Voss, Lead Threat Researcher"
canonical: "https://zerodayrat.shop/zerodayrat-vs-stalkerware"
---

# ZeroDayRAT vs Stalkerware: Threat Taxonomy

**Evidence classification: Analytical Assessment** — This taxonomy positions ZeroDayRAT relative to consumer stalkerware and mercenary spyware based on public reporting.

## Where ZeroDayRAT Sits

The mobile surveillance threat landscape has three tiers:

1. **Consumer stalkerware** — Commercial apps sold for "monitoring" (partners, children, employees). Widely available, low cost, limited capability. Often detected by standard security tools.
2. **Commercial RAT / spyware** — ZeroDayRAT occupies this tier. Sold commercially, broader capability than stalkerware, per-operator infrastructure. More capable than consumer stalkerware, less sophisticated than mercenary spyware.
3. **Mercenary spyware** — Pegasus and similar. Government-grade, zero-click capability, extensively documented, very expensive.

## Comparison

| Dimension | Consumer Stalkerware | ZeroDayRAT | Mercenary Spyware |
|-----------|---------------------|-----------|-------------------|
| **Cost** | Very low ($10-50/mo) | Low-moderate | Very high (government budget) |
| **Distribution** | App stores (sometimes), direct download | Commercial sale, sideloading | Government contracts |
| **Capability** | Location, SMS, basic monitoring | Full surveillance suite | Full device access, zero-click |
| **iOS** | Limited (MDM abuse) | Advertised, unconfirmed | Demonstrated |
| **Detection** | Often detected by AV | Harder — hides from AV | Very hard — requires forensic tools |
| **Targeting** | Intimate partner, family | Broad, any buyer | High-value individuals |
| **Infrastructure** | Shared vendor servers | Per-operator | Vendor-controlled |
| **Evidence** | Well-documented | Reported, limited analysis | Extensively documented |

## Why the Distinction Matters

**For defenders**: The tier determines your detection strategy. Consumer stalkerware is often detectable by standard mobile security apps. ZeroDayRAT requires permission auditing and behavioral detection. Mercenary spyware may require forensic analysis (like MVT - Mobile Verification Toolkit).

**For victims**: Consumer stalkerware is typically installed by someone with physical access to the device (a partner, parent, employer). ZeroDayRAT may be installed via social engineering or targeted delivery. Mercenary spyware may be deployed remotely via zero-click exploits.

**For attribution**: Consumer stalkerware is easy to trace (the vendor is known). ZeroDayRAT is harder (per-operator infrastructure). Mercenary spyware is the hardest (sophisticated operational security).

## The Commoditization Problem

ZeroDayRAT represents the **commoditization of surveillance capability**. Features that were once exclusive to government-grade spyware — camera activation, microphone surveillance, keylogging, OTP interception — are now commercially available at a fraction of the cost.

This means:
- **More operators** can deploy sophisticated surveillance
- **More targets** are at risk
- **Attribution** is harder (fragmented infrastructure)
- **Takedown** is less effective (no single vendor to pressure)

## FAQ

### Is ZeroDayRAT stalkerware?

ZeroDayRAT has stalkerware-like capabilities but is more capable. Consumer stalkerware apps are typically sold through app stores or websites with "monitoring" framing. ZeroDayRAT is sold as a RAT with broader surveillance capability. The line is blurry, but ZeroDayRAT's capability set (OTP interception, keylogging, screen capture) goes beyond typical stalkerware.

### Can stalkerware detectors find ZeroDayRAT?

Consumer stalkerware detection apps (like TinyCheck or Certo) may detect some ZeroDayRAT indicators, but commercial RATs are designed to evade standard detection. Permission auditing and behavioral analysis are more reliable. See the [Detection Guide](/detection.md).

### What about the Coalition Against Stalkerware?

The [Coalition Against Stalkerware](https://stopstalkerware.org) is a resource for victims of consumer stalkerware. ZeroDayRAT's commercial model and broader capability set place it outside the typical stalkerware category, but the defensive guidance overlaps.

## Sources

- [iVerify](https://iverify.com) — ZeroDayRAT mobile research reporting
- [SecurityWeek](https://securityweek.com) — coverage of advertised platform functionality
- [BleepingComputer](https://bleepingcomputer.com) — technical analysis reporting
- [ThaiCERT](https://thaicert.or.th) — advisory summarising reported functionality
- [Dark Reading](https://darkreading.com) — threat landscape analysis
- [Coalition Against Stalkerware](https://stopstalkerware.org) — stalkerware resources and victim support