By Jackson Godwin | Cybersecurity Analyst & Penetration Tester | info@jacksontechnology.com.ng
Introduction
A new mobile spyware platform, ZeroDayRAT, has been making waves in the cybersecurity community since early February 2026. Unlike older malware families that focused on stealing a single category of data, ZeroDayRAT is being marketed on Telegram as a comprehensive mobile compromise toolkit — providing buyers with real-time access to a victim's camera, microphone, messages, location, and even their bank and cryptocurrency wallets.
For individuals and organizations across Africa, where mobile-first banking and BYOD (Bring Your Own Device) culture are the norm, this is a serious wake-up call.
What Is ZeroDayRAT?
ZeroDayRAT is a cross-platform Remote Access Trojan (RAT) sold as a commercial product, complete with a builder for generating malicious apps and a self-hosted web dashboard for managing infected devices. It supports:
- Android versions 5 through 16
- iOS versions up to 26 (including the iPhone 17 Pro)
No advanced technical skill is required to operate it — the dashboard does the work, which is part of what makes this threat so dangerous. Full access reportedly sells for around $2,000, placing it above casual "script kiddie" tools but well within reach of organised fraud groups.
How It Spreads
ZeroDayRAT does not rely on a zero-click exploit. Instead, it depends on social engineering, including:
- Smishing (SMS phishing) messages about "missed deliveries" or "critical updates."
- Phishing emails with malicious links
- Fake or cracked versions of popular apps on unofficial app stores
- Malicious links shared via WhatsApp or Telegram
On Android, victims are tricked into installing an APK. On iOS, victims install a malicious configuration profile or payload.
What It Can Do
Once installed, ZeroDayRAT gives an attacker a dashboard showing the device model, OS version, battery status, SIM and carrier details, location, and lock state. From there, capabilities include:
Surveillance
- Live streaming from front and rear cameras
- Microphone eavesdropping
- Real-time screen recording
- GPS tracking with full location history plotted on Google Maps
Data Theft
- SMS interception, including one-time passwords (OTPs) — enabling MFA bypass
- Call logs, contacts, app usage, and notification history (WhatsApp, Telegram, Instagram, etc.)
- Keylogging of everything typed, including passwords and PINs
Financial Theft
- A crypto stealer that detects wallets like MetaMask, Trust Wallet, Binance, and Coinbase, and hijacks the clipboard to redirect transfers to attacker-controlled addresses
- A "bank stealer" module targeting Apple Pay, Google Pay, PayPal, and PhonePe via overlay attacks
Security researchers have described ZeroDayRAT as "textbook stalkerware" — meaning the same tool can be used for financial fraud, corporate espionage, or monitoring an individual without their knowledge.
Why This Matters for Africa's Digital Economy
With mobile money platforms, USSD banking, and app-based wallets forming the backbone of financial inclusion across the continent, a tool like ZeroDayRAT represents a direct threat to:
- Individuals using mobile banking and crypto wallets
- SMEs relying on personal devices for business communication (BYOD)
- Journalists, activists, and anyone who may be a stalkerware target
- Organisations without mobile device management (MDM) policies
The fact that SMS-based OTPs can be intercepted is especially relevant — many local banking apps and platforms still rely on SMS as a second factor.
How to Protect Yourself and Your Organisation
- Avoid third-party app stores. Only install apps from the official Google Play Store or Apple App Store.
- Be skeptical of unexpected links, especially "delivery" or "account update" messages via SMS, email, or WhatsApp.
- Update your devices. Apple released iOS 26.3 on 11 February 2026 to patch a related memory vulnerability (CVE-2026-20700). Keep both Android and iOS devices fully patched.
- Move away from SMS-based MFA where possible — use authenticator apps or hardware security keys instead.
- For organizations: enforce MDM (Mobile Device Management) and app vetting policies, especially for BYOD environments.
- Review app permissions regularly — particularly camera, microphone, SMS, and accessibility permissions.
- Monitor for unusual battery drain, data usage, or device behaviour, which can indicate spyware activity.
Final Thoughts
ZeroDayRAT is a reminder that mobile devices deserve the same security attention as laptops and corporate endpoints — arguably more, given how much financial and personal data now lives in our pockets. As cyber threats continue to evolve, building awareness and practical defensive skills remains the first line of defence.
Want to build the skills to detect and defend against threats like ZeroDayRAT? Explore TechTrain Academy's cybersecurity training programs designed to build Africa's next generation of security professionals.
References
- "ZeroDayRAT malware grants full access to Android, iOS devices" – BleepingComputer
- "New Zero-Day RAT Mobile Spyware Enables Real-Time Surveillance and Data Theft" – The Hacker News
- "In Bypassing MFA, ZeroDayRAT Is 'Textbook Stalkerware'" – Dark Reading
- "ZeroDayRAT spyware targets Android and iOS devices via commercial toolkit" – CSO Online
- iVerify Research Blog