Quick Summary
A new mobile spyware called ZeroDayRAT is being marketed on Telegram, granting cybercriminals complete control over compromised Android and iOS devices. It supports Android versions 5 through 16 and iOS up to version 26. Researchers from iVerify warn that this malware not only steals sensitive data but also enables real-time surveillance and financial theft, posing significant risks to individual privacy and enterprise security.
The Securityish Brief
ZeroDayRAT is a commercial mobile spyware platform that has emerged as a significant threat to both Android and iOS users. Advertised on Telegram, it allows cybercriminals to gain full remote control over devices running Android versions 5 to 16 and iOS up to version 26. Researchers from iVerify have highlighted the malware’s capabilities, which include not just data theft but also real-time surveillance and financial theft.
The malware features a comprehensive management panel that displays information about compromised devices, including model, operating system version, battery status, SIM details, and more. It can log app usage, SMS exchanges, and even track victims in real time if GPS access is granted. This level of access allows attackers to monitor victims closely and exploit them for financial gain.
ZeroDayRAT also includes active functionalities, such as activating the device’s cameras and microphone, which can provide live media feeds or record screens to capture sensitive information. The malware can capture incoming one-time passwords (OTPs) to bypass two-factor authentication and send SMS messages from the victim’s device.
Additionally, it features a keylogging module that records user inputs, including passwords and gestures. A cryptocurrency stealer module targets wallet apps like MetaMask and Binance, logging wallet IDs and attempting to replace copied wallet addresses with those controlled by attackers. The bank stealer component targets online banking apps and payment services, enabling credential theft through fake screens.
iVerify has not disclosed how ZeroDayRAT is delivered, but they classify it as a complete mobile compromise toolkit. The implications of a compromised device are severe, potentially leading to breaches within organizations if an employee’s device is affected. For individuals, the risks include significant privacy violations and financial losses.
Understanding the Risks
Users are advised to only download apps from official app stores, such as Google Play and the Apple Store, and to install applications from reputable publishers. High-risk users should consider enabling Lockdown Mode on iOS and Advanced Protection on Android to enhance their security posture.
Key Takeaways
- Only download apps from official app stores like Google Play and Apple Store.
- Install applications from reputable publishers to reduce the risk of malware.
- Enable Lockdown Mode on iOS and Advanced Protection on Android for enhanced security.
- Regularly monitor your device for unusual activity or unauthorized access.
- Be cautious of SMS messages requesting sensitive information or OTPs.
Key Terms & Concepts
- ZeroDayRAT: In this article, ZeroDayRAT refers to a new mobile spyware platform that allows full remote control over Android and iOS devices.
- keylogging: Keylogging is a technique used to capture user input, such as passwords and gestures, often employed by malware to steal sensitive information.
- two-factor authentication (2FA): Two-factor authentication is a security process that requires two different forms of identification to access an account, enhancing security against unauthorized access.
- cryptocurrency stealer: A cryptocurrency stealer is a type of malware designed to target cryptocurrency wallet applications to steal sensitive information like wallet IDs and balances.
Read the original article here: https://www.bleepingcomputer.com/news/security/zerodayrat-malware-grants-full-access-to-android-ios-devices/
Your 5-Minute Securityish Brief
A weekly digest of cybersecurity news, phishing alerts, privacy tips, and emerging threats, simplified so anyone can understand what matters and why.
Securityish
Securityish explains cybersecurity, scams, data breaches, and privacy risks in simple language so you know what’s happening and how to protect yourself.
© 2026 Securityish
