Capabilities once reserved for nation-state operators are now packaged, documented, and sold simply on Telegram with customer support, they noted.
Broad surveillance and credential theft
ZeroDayRAT is designed as a mobile surveillance and data exfiltration platform rather than a simple infostealer. According to iVerify, the malware can collect a wide range of sensitive data from the infected devices, including messages, call logs, contacts, location information, photos, and files. It can also harvest notifications and device metadata, giving operators visibility into both user activity and installed applications.
“Notifications are captured separately: app name, title, content, timestamp,” the researchers said. “WhatsApp messages, Instagram notifications, missed calls, Telegram updates, YouTube alerts, system events. Without opening a single app, an attacker has passive visibility into nearly everything happening on the phone.”