ZeroDayRAT Mobile Spyware Enables Real-Time Surveillance and Data Theft
- Securityish
- Threats & Incidents
Quick Summary
Cybersecurity researchers have revealed a new mobile spyware called ZeroDayRAT, which is marketed on Telegram for real-time surveillance and data theft on Android and iOS devices. This malware targets devices running Android versions 5 through 16 and iOS versions up to 26, allowing attackers to access sensitive information such as location, app usage, and financial data. The spyware can log keystrokes, gather SMS messages, and even reroute cryptocurrency transactions, posing significant risks to both individuals and organizations.
The Securityish Brief
ZeroDayRAT is a newly discovered mobile spyware platform that enables real-time surveillance and data theft from Android and iOS devices. It is being promoted on Telegram, where the developer maintains dedicated channels for sales and customer support. This malware supports a wide range of Android versions (5 to 16) and iOS versions (up to 26), making it accessible to a large number of potential victims.
The spyware is distributed primarily through social engineering tactics or fake app marketplaces. Once installed, it provides the operator with extensive access to the victim’s device, including model, location, operating system, app usage, and notifications. The spyware can even track GPS coordinates and plot them on Google Maps, effectively allowing for continuous monitoring.
One of the most concerning features of ZeroDayRAT is its ability to enumerate all accounts registered on the device, such as Google, WhatsApp, Instagram, and more, along with their associated usernames or emails. This information can be exploited for further attacks or identity theft.
ZeroDayRAT also includes capabilities for logging keystrokes and gathering SMS messages, including one-time passwords (OTPs), which can undermine two-factor authentication. Additionally, it allows for real-time surveillance through live camera streaming and microphone access, significantly increasing the threat level.
Financial theft is another critical aspect of this malware, which includes a stealer component that targets wallet apps like MetaMask and Binance. It can substitute wallet addresses copied to the clipboard, redirecting transactions to the attacker’s wallet. Furthermore, a bank stealer module is designed to target online mobile wallet platforms, including Apple Pay and Google Pay.
The emergence of ZeroDayRAT highlights the evolving sophistication of mobile-focused cyber threats, as it combines surveillance, data theft, and financial fraud capabilities into a single toolkit. This development is particularly alarming given that such tools were previously only available to nation-states or highly skilled hackers.
Recent reports indicate a rise in various mobile malware campaigns, including an Android RAT campaign that has used Hugging Face to distribute malicious APK files and a banking trojan called deVixor targeting Iranian users. These incidents underscore the need for heightened awareness and vigilance among users and organizations alike.
- ZeroDayRAT: A mobile spyware platform enabling real-time surveillance and data theft on Android and iOS devices.
- Hugging Face: An Android RAT campaign using this platform to host and distribute malicious APK files.
- deVixor: An Android banking trojan actively targeting Iranian users through phishing websites.
- Anatsa: A banking trojan distributed via a document reader app on the Google Play Store.
- ShadowRemit: A malicious campaign exploiting fake Android apps for unauthorized cross-border money transfers.
Key Takeaways
- Regularly update your mobile operating system and apps to protect against known vulnerabilities.
- Be cautious of downloading apps from unofficial sources or clicking on suspicious links in messages.
- Monitor your financial accounts for unauthorized transactions and report any suspicious activity immediately.
- Enable two-factor authentication on all accounts to add an extra layer of security.
- Educate yourself about social engineering tactics to recognize potential phishing attempts.
Key Terms & Concepts
- ZeroDayRAT: In this article, ZeroDayRAT refers to a new mobile spyware platform that facilitates real-time surveillance and data theft.
- RAT: RAT stands for Remote Access Trojan, a type of malware that allows unauthorized access to a victim’s device.
- GPS coordinates: GPS coordinates are numerical values that specify a location on the Earth’s surface, used for tracking and navigation.
- two-factor authentication: Two-factor authentication is a security process that requires two different forms of identification before granting access to an account.
- social engineering: Social engineering refers to manipulation techniques used to trick individuals into divulging confidential information.
Read the original article here: https://thehackernews.com/2026/02/new-zerodayrat-mobile-spyware-enables.html
Your 5-Minute Securityish Brief
A weekly digest of cybersecurity news, phishing alerts, privacy tips, and emerging threats, simplified so anyone can understand what matters and why.
Securityish
Securityish explains cybersecurity, scams, data breaches, and privacy risks in simple language so you know what’s happening and how to protect yourself.
© 2026 Securityish
