ZeroDayRAT mobile spyware targeting Android and iOS
Malware Activity
Summary
Hide ▲
Show ▼
ZeroDayRAT is a newly documented mobile spyware operation targeting Android and iOS devices, creating broad risk for persistent surveillance and financial abuse. It can expose communications, precise location data, and banking activity once a victim installs the malicious payload. The tool’s access to a web dashboard and theft modules makes credential theft, account takeover, and data exfiltration more likely after infection.
Related Happenings
BTMOB Android RAT no-code builder malware activity
Malware Activity
First: 26.05.2026 17:00
Last: 26.05.2026 17:00
Sources 1
About this happening:
The **BTMOB** Android RAT is spreading through **phishing campaigns** across **Brazil and beyond**, raising the risk of **custom payload delivery** and **remote device takeover**....
BTMOB Android RAT no-code builder malware activity
Malware ActivityAbout this happening: The **BTMOB** Android RAT is spreading through **phishing campaigns** across **Brazil and beyond**, raising the risk of **custom payload delivery** and **remote device takeover**....
AI-driven attack surge against customer-facing mobile apps in 2026
Target Trend
First: 19.05.2026 15:00
Last: 19.05.2026 15:00
Sources 1
About this happening:
**Customer-facing mobile apps** faced a sharp rise in attacks in **2026**, with **87%** of monitored apps hit versus **55% in 2022**. The trend matters because **agentic AI** is l...
AI-driven attack surge against customer-facing mobile apps in 2026
Target TrendAbout this happening: **Customer-facing mobile apps** faced a sharp rise in attacks in **2026**, with **87%** of monitored apps hit versus **55% in 2022**. The trend matters because **agentic AI** is l...
Android Intrusion Logging forensic logging rollout for spyware investigations
Security Tool/Service
First: 13.05.2026 09:55
Last: 13.05.2026 09:55
Sources 1
About this happening:
**Android** is adding **Intrusion Logging**, an opt-in forensic feature in **Advanced Protection Mode** that preserves device and network activity for suspected spyware compromise...
Android Intrusion Logging forensic logging rollout for spyware investigations
Security Tool/ServiceAbout this happening: **Android** is adding **Intrusion Logging**, an opt-in forensic feature in **Advanced Protection Mode** that preserves device and network activity for suspected spyware compromise...
Android 17 expands platform security and privacy protections
Security Tool/Service
First: 12.05.2026 20:00
Last: 12.05.2026 20:00
Sources 1
About this happening:
**Android 17** will add a broad set of **Google**-backed security and privacy controls next month, reducing exposure to **banking scam calls**, **device theft**, and **OTP theft**...
Android 17 expands platform security and privacy protections
Security Tool/ServiceAbout this happening: **Android 17** will add a broad set of **Google**-backed security and privacy controls next month, reducing exposure to **banking scam calls**, **device theft**, and **OTP theft**...
Apple and Google Messages beta rollout of cross-platform E2EE RCS
Security Tool/Service
First: 12.05.2026 16:00
Last: 12.05.2026 16:00
Sources 1
About this happening:
Apple and Google have begun a **beta rollout** of **end-to-end encrypted RCS** between **iPhone** and **Android** devices, materially reducing carrier and in-transit visibility fo...
Apple and Google Messages beta rollout of cross-platform E2EE RCS
Security Tool/ServiceAbout this happening: Apple and Google have begun a **beta rollout** of **end-to-end encrypted RCS** between **iPhone** and **Android** devices, materially reducing carrier and in-transit visibility fo...
Timeline
-
10.02.2026 16:00 2 articles · 3mo ago
ZeroDayRAT documented targeting Android and iOS
Initial DisclosureZeroDayRAT is a mobile spyware operation targeting Android and iOS devices, installed when a victim is persuaded to install a malicious Android APK or iOS payload, often through smishing, phishing emails, counterfeit app stores, or links shared through WhatsApp or Telegram; once deployed, it provides persistent access to communications, precise location data, banking activity, camera, microphone, keystrokes, and a web-based dashboard, and it includes crypto-stealing and banking-stealing modules aimed at PhonePe, Google Pay, Apple Pay and PayPal.
Show sources
- New Mobile Spyware ZeroDayRAT Targets Android and iOS — www.infosecurity-magazine.com — 10.02.2026 16:00
- In Bypassing MFA, ZeroDayRAT Is 'Textbook Stalkerware' — www.darkreading.com — 10.02.2026 23:37