This Aggressive Spyware Is Targeting Both Android and iOS Devices

Threat actors don’t have to work very hard to obtain sophisticated malware to deploy against unsuspecting targets. A new spyware platform known as ZeroDayRAT is reportedly being sold on Telegram, complete with customer support and updates.

According to mobile security company iVerify, this aggressive spyware offers complete remote control over devices running Android 15 to 16 and iOS versions up to iOS 26. Once deployed, it enables everything from user profiling and location tracking to live surveillance and financial theft.

What ZeroDayRAT can collect from your device

This spyware has extensive capabilities that iVerify says are traditionally found on platforms sponsored by state actors. Here’s an overview of what ZeroDayRAT can do:

• Collect device information such as model, OS, battery, country, lock status, SIM card and carrier information, app usage, live activity, and SMS message previews. This allows threat actors to develop user profiles for later targeting.

• Extract GPS coordinates, capture app and system notifications, and harvest account information, such as usernames and emails.

• Send SMS messages and receive verification codes to bypass two-factor authentication.

• Record keystrokes (including biometric unlocks, gestures and app launches), access camera and microphone, and screen recording.

• Record crypto wallet addresses and target banking and payment app credentials via overlay attacks.

How to protect yourself against spyware

ZeroDayRAT can only infect your device if a malicious binary (an APK on an Android or iOS payload) is downloaded and installed. These can be distributed through phishing, such as links sent via emails, SMS or messaging platforms, as well as in fake app stores.

All the standard tips for avoiding scams and malware apply: never click on links in unsolicited communications, including conversations in apps like Telegram and WhatsApp, and only download apps and extensions from official, trusted sources.

Users at high risk of being targeted and anyone wanting an extra layer of security may consider enabling Lockdown Mode (iOS) or Advanced Protection (Android).