NEW 'ZERODAYRAT' SPYWARE KIT ENABLES TOTAL COMPROMISE OF IOS, ANDROID DEVICES

Summary from the TLDR InfoSec newsletter

A new commercial mobile spyware toolkit, ZeroDayRAT, sold via Telegram and analyzed by iVerify, offers nation-state-level capabilities, including live camera and microphone feeds, keylogging, GPS tracking, bank credential theft, and crypto clipboard hijacking, for both Android and iOS devices. The self-hosted kit uses a builder model in which operators generate payloads for their own infrastructure, distributing them via phishing, smishing, or trojanized apps. The creators deliberately obscure attribution by advertising in five languages and mixing Chinese, Russian, and Indian targeting indicators. Takedown efforts have been complicated by the decentralized operator model and Telegram's slow enforcement, making this a persistent threat with few available IoCs beyond unusual battery drain and unexplained financial transactions.