ZeroDayRAT: Defensive Intelligence Analysis of a Commoditized Mobile Surveillance Platform

A New Tier of Mobile Surveillance Threat

In February 2026, security researchers publicly documented ZeroDayRAT, a commercially marketed mobile remote-access and surveillance platform. Unlike bespoke nation-state implants such as Pegasus or Predator, ZeroDayRAT sits in a different tier of threat: commoditized malware-as-a-service, sold behind an operator dashboard with documentation and support channels that lower the barrier to entry far below traditional mercenary spyware.

The ZeroDayRAT Intelligence Center — an independent threat-intelligence resource powered by SpyPhone.Shop — publishes defensive research on the platform, including capability analysis, attack-chain modeling, and a capability-to-permission mapping designed to help security teams translate reported threats into concrete MDM and permission-policy actions.

Reported Capabilities

Reported functionality includes:

• Device profiling and fingerprinting — handset model, OS build, carrier and locale data.
• Location tracking and history — real-time position and pattern-of-life movement.
• SMS and OTP interception — exposing conversations and SMS-delivered one-time codes.
• Notification visibility — surfacing message previews and alerts from protected apps.
• Screen monitoring and keylogging — capturing decrypted content and typed credentials.
• Camera and microphone surveillance — advertised but not independently demonstrated.
• Financial targeting — banking, crypto wallet and clipboard manipulation, advertised.
• Remote administration — a centralized operator console for issuing commands and tuning collection.

The platform's own research portal is careful to separate reported capabilities (independently observed) from advertised / claimed ones (seller marketing only) and unconfirmed items — a discipline Encrygma endorses and applies here.

Zero-Day in Name, Not in Evidence

Despite the name, public evidence does not establish that ZeroDayRAT relies on a genuine zero-day or zero-click exploit chain. A RAT is not automatically a zero-day; a zero-day is not automatically zero-click. Reported delivery involves user interaction (social engineering and installation) rather than a demonstrated silent exploit. Defenders should treat the "zero-day" framing as marketing, not a technical finding.

Why the Commoditization Matters

The strategic significance is commoditization: surveillance capability packaged behind an operator console and sold to multiple buyers. Each operator may run separate infrastructure, choose different delivery pretexts, and enable different capability subsets. Indicators from one incident may not generalize to another, so detection strategies that depend on fixed domain lists or single file hashes age quickly. The defensive playbook is therefore not the Pegasus playbook — it is permission governance, MDM policy, and behavioral correlation.

Capability-to-Permission Mapping

The ZeroDayRAT Intelligence Center publishes an original mapping of each reported capability to the Android permission or API surface it requires, and the iOS constraint that limits or prevents it. Selected rows:

| Reported Capability | Android Surface | iOS Constraint | |---|---|---| | SMS / OTP interception | RECEIVE_SMS, READ_SMS | No direct SMS access | | Notification access | NotificationListenerService | Not directly accessible | | Camera surveillance | CAMERA + foreground service | Indicator mandatory; background constrained | | Keylogging | Accessibility Service | No system-wide keylogging | | Screen monitoring | MediaProjection API | Per-session consent prompt | | Clipboard manipulation | Clipboard manager | Restricted from iOS 14+ |

This mapping is the bridge between a threat report and an actionable policy: enforce the Android permissions in the right-hand column and the corresponding capability becomes materially harder to exercise regardless of which operator deploys the tool.

Defensive Implications

• Permission governance. Audit and restrict the Android permissions above across managed fleets; block sideloaded apps requesting them.
• MDD policy. Deny Accessibility Service and overlay permissions to untrusted apps; enforce allowlists for notification listeners.
• Behavioral detection. Correlate foreground-service camera/mic use with no user-facing app; flag unexpected notification-listener enrollment.
• iOS posture. iOS platform constraints materially limit several capabilities; ensure MDM profiles and exploit mitigations remain current.
• Identity rotation. Assume identity compromise follows device compromise — rotate credentials, MFA factors and sessions after any confirmed compromise.

Sources

• ZeroDayRAT Intelligence Center — https://zerodayrat.shop/
• ZeroDayRAT overview — https://zerodayrat.shop/what-is-zerodayrat
• Capability analysis — https://zerodayrat.shop/capabilities
• Attack-chain model — https://zerodayrat.shop/attack-chain