ZeroDayRAT: Threat Analysis of a Commoditized Mobile Surveillance Platform

1. Background

ZeroDayRAT entered public cybersecurity discussion in February 2026. Researchers described a package consisting of a mobile component that runs on a target device and a management interface through which an operator issues instructions and reviews collected information. The ZeroDayRAT Intelligence Center — an independent threat-intelligence resource — publishes defensive research on the platform, including capability analysis, attack-chain modeling, and an original capability-to-permission mapping.

2. Capability Set

Reported capabilities include:

• Device profiling and fingerprinting
• SIM and carrier information
• Application intelligence (installed banking, messaging, authenticator and corporate apps)
• Location tracking and location history
• SMS collection and OTP exposure
• Notification visibility
• Screen monitoring and keylogging
• Clipboard manipulation
• Remote administration

Advertised but not independently demonstrated: camera surveillance, microphone surveillance, banking credential targeting, cryptocurrency targeting.

3. Evidence-Confidence Matrix

A disciplined separation of evidence is essential to calibrating defensive investment.

| Claim / Capability | Evidence Basis | Status | |---|---|---| | Commercial availability with operator dashboard | Marketing + researcher observation | Reported | | Android device profiling and location collection | Researcher analysis | Reported | | SMS / OTP interception on Android | Reported + platform feasibility | Reported | | Camera and microphone surveillance | Operator marketing | Advertised / Claimed | | Screen monitoring and keylogging | Operator marketing | Advertised / Claimed | | Financial targeting (banking / crypto) | Advertised capability set | Advertised / Claimed | | iOS full-spectrum surveillance | Seller compatibility claims | Unconfirmed | | Genuine zero-day exploit chain | Interface label referencing "exploit" | Unconfirmed | | Zero-click installation | Implied by name; not demonstrated | Unconfirmed |

Treat Reported items as the planning baseline. Treat Advertised items as plausible but unverified. Treat Unconfirmed items as risk to watch, not fact to build against.

4. Capability-to-Permission Mapping

The most actionable contribution of the research is a mapping of each reported capability to the Android permission or API surface it requires, and the iOS constraint that limits or prevents it.

| Reported Capability | Android Surface | iOS Constraint | |---|---|---| | Device profiling | READ_PHONE_STATE, package queries | Limited; sandboxed | | Location tracking | ACCESS_FINE_LOCATION, background location | Always-Use authorization prompted | | SMS / OTP interception | RECEIVE_SMS, READ_SMS | No direct SMS access | | Notification access | NotificationListenerService | Not directly accessible | | Camera surveillance | CAMERA, foreground service | Indicator mandatory; background constrained | | Microphone surveillance | RECORD_AUDIO, foreground service | Indicator mandatory; background constrained | | Screen monitoring | MediaProjection API | Per-session consent prompt | | Keylogging | Accessibility Service | No system-wide keylogging | | Clipboard manipulation | Clipboard manager | Restricted from iOS 14+ | | Financial targeting | SYSTEM_ALERT_WINDOW, accessibility | No system-wide overlay | | Remote command execution | Foreground service, network socket | Background networking limited | | Persistence | RECEIVE_BOOT_COMPLETED, accessibility | No background daemon; exploit or MDM required |

This mapping is the bridge between a threat report and an actionable MDM policy: enforce the Android permissions in the right-hand column and the corresponding capability becomes materially harder to exercise regardless of which operator deploys the tool.

5. Attack-Chain Model

The research portal publishes a conceptual lifecycle used to align defensive visibility to each stage:

1. Reconnaissance — target selection and profiling.
2. Social engineering / delivery — a pretext persuades installation.
3. Malicious mobile component — a mobile application is introduced.
4. Permission or execution stage — access expands through granted permissions.
5. Collection — device, location, message, notification and input data gathered.
6. Remote control — operator interface issues instructions and tunes collection.
7. Exfiltration — collected data transferred to operator infrastructure.
8. Identity / financial / surveillance impact — downstream effects.

This lifecycle is educational and conceptual. Encrygma does not reproduce infection procedures, payload generation, packaging methods, or command-and-control deployment instructions.

6. Spyware Commoditization Spectrum

Positioning commercial mobile surveillance tools by operator accessibility rather than capability set:

| Tier | Category | Examples | Operator Barrier | Detection Posture | |---|---|---|---|---| | Tier 0 | Bespoke / Nation-State | Pegasus, Predator | Extremely high | Advanced MTD, forensic analysis | | Tier 1 | Commercial Mercenary | FinFisher, Cytrox-era | High | Targeted hunting, specialized IOCs | | Tier 2 | Commoditized MaaS | ZeroDayRAT (reported) | Low-to-moderate | Permission auditing, behavioral correlation, MDM | | Tier 3 | Consumer Stalkerware | App-store-adjacent monitoring apps | Very low | MDM blocklists, user education |

ZeroDayRAT occupies Tier 2. The standard Pegasus playbook does not transfer; Tier 2 threats are defeated by permission governance, MDM policy, and behavioral correlation.

7. Control Framework

Immediate (0–7 days)

1. Distribute detection guidance for reported indicators and permission patterns.
2. Audit managed fleets for apps holding Accessibility Service, notification-listener, overlay and SMS permissions.
3. Block sideloaded apps requesting the permissions above.

Short-term (7–30 days)

4. Enforce MDM policies restricting the Android permissions in Section 4 to allowlisted apps.
5. Deploy behavioral detection rules: foreground-service camera/mic use with no user-facing app; unexpected notification-listener enrollment.
6. Prepare identity-rotation runbooks: credentials, MFA factors, sessions after confirmed compromise.

Structural (30–90 days)

7. Integrate capability-to-permission mapping into mobile onboarding and app-review workflows.
8. Track operator-infrastructure churn; avoid detection strategies that depend on fixed domain lists or single hashes.
9. Include commoditized mobile surveillance in tabletop exercises and insider-threat programs.

8. Assessment

Encrygma assesses with high confidence that the commoditization model represented by ZeroDayRAT will expand across 2026–2027, increasing the number of distinct operator infrastructure clusters defenders face and accelerating indicator churn. The durable controls are permission governance, MDM enforcement, and behavioral detection — not exploit-mitigation tooling.

References

• ZeroDayRAT Intelligence Center — https://zerodayrat.shop/
• What is ZeroDayRAT? — https://zerodayrat.shop/what-is-zerodayrat
• Capability analysis — https://zerodayrat.shop/capabilities
• Attack-chain model — https://zerodayrat.shop/attack-chain