ZeroDayRAT is a newly identified mobile spyware family that openly targets both Android and iOS devices. Sold via Telegram for $2,000, it grants attackers ‘stalkerware-grade’ access to infected devices, affecting Android versions 5–16 and iOS up to version 26. ZeroDayRAT commoditizes a range of capabilities, including keylogging, SMS control (enabling the bypassing of multifactor authentication), microphone access, screen recording, and the theft of credentials and financial data from apps.
The spyware allows attackers to build a complete profile of the device by collecting SIM information, location data, SMS previews, and all registered accounts. This is achieved without requiring significant technical expertise, making these advanced surveillance abilities accessible to non-technical users. Attackers distribute the malware via smishing and phishing attacks or through fake app stores, posing a risk to enterprises with bring-your-own-device (BYOD) policies, as well as to journalists, activists, and domestic abuse victims.
Notably, ZeroDayRAT includes a web-based management panel with detailed documentation and customer support, enabling even novice attackers to deploy and manage the spyware effectively. It achieves its infiltration not through sophisticated zero-day exploits but rather through social engineering tactics that trick users into downloading malicious apps or configuration profiles.
Security researchers have warned that ZeroDayRAT represents ‘textbook stalkerware’ capabilities that were once the domain of nation-state-level cyber operations, now readily available on the open market. With its cross-platform reach and comprehensive surveillance features, ZeroDayRAT is a significant threat to personal and organizational security globally.

Collections

ZeroDayRAT is a newly discovered cross-platform mobile spyware sold on Telegram for $2,000, targeting Android (versions 5–16) and iOS (up to version 26). It offers stalkerware-grade capabilities including keylogging, SMS interception (enabling MFA bypass), microphone access, screen recording, and credential theft. Distribution relies on social engineering via smishing, phishing, and fake app stores rather than zero-day exploits. A web-based management panel with documentation and customer support makes it accessible to non-technical attackers. It poses significant risks to enterprises with BYOD policies, journalists, activists, and domestic abuse victims, representing nation-state-level surveillance capabilities now commoditized on the open market.

ZeroDayRAT: A Comprehensive Mobile Spyware Threat to Android and iOS