ZERODAYRAT is a new mobile spyware platform advertised on Telegram that offers real-time surveillance and data theft for Android and iOS devices. It supports Android versions 5 through 16 and iOS versions up to 26, and is distributed via social engineering or fake app marketplaces with binaries generated by a builder provided to buyers, who also receive an online panel to run on their own server.
Once installed, the operator can view device details such as model, location, battery status, SIM and carrier data, app usage, notifications, and even a preview of recent SMS messages through a self-hosted panel, enabling profiling of the victim and their communications. The platform also enables live surveillance via a camera and microphone, with keystroke logging and SMS gathering, including one-time passwords to defeat two-factor authentication.
To monetise the spyware, the malware includes a stealer component that targets wallets and bank apps to substitute wallet addresses and facilitate transfers, with the operator able to access accounts such as Google, WhatsApp, Instagram, Facebook, Telegram, and more, according to iVerify.