ZeroDayRAT spyware sold on Telegram offers phone surveillance and bank and crypto theft
ZeroDayRAT is spyware sold on Telegram that claims to control Android and iPhones: camera, mic, location, texts and codes, plus bank and crypto theft. It needs you to install a fake app, usually from a text link. Don't install apps from links; use official stores only.
Don't install apps from links in texts, emails or chat messages; use only the official App Store or Google Play. If a phone behaves oddly or a banking app asks to log in unexpectedly, contact your bank and have the device checked. Keep iOS and Android updated.
What’s happening
ZeroDayRAT is a commercial spyware kit that iVerify, a mobile security company, identified in early February 2026. Its seller advertises it on Telegram, with separate sales, support and update channels. It is advertised as working on Android 5 to 16 and on iOS up to version 26. Reported abilities include live camera, screen and microphone access, GPS tracking, reading and sending text messages, capturing one-time login codes, logging keystrokes, copying notifications from apps such as WhatsApp, fake overlays on banking apps, and swapping crypto wallet addresses copied to the clipboard. It does not break into a phone by itself. The victim has to install a malicious Android app file or an iOS payload, most often after a text message link to a fake app. Phishing emails, fake app stores and links sent over WhatsApp or Telegram are also used. iVerify's screenshots show devices reporting from multiple countries, but no victim count or named victims have been published. No vendor fix applies, since this is malware rather than a software flaw. As of today, no later developments have been reported in the sources reviewed.
- What
- Scam
- Affects
- Android and iPhone devices (ZeroDayRAT spyware kit)
- Affected
- Android 5 to 16 (as advertised by the seller)
iOS up to 26 (as advertised by the seller) - Fixed in
- Nothing to patch
- Since
- 2 Feb 2026
- Closed
- 10 Feb 2026
Timeline
- UpdateNothing to patch
Infosecurity Magazine reported the findings. It said the usual lure is a text message linking to a fake app, and that no specific victims were named.
- Made publicNothing to patch
iVerify published its analysis: the kit advertises support for Android 5 to 16 and iOS up to 26, with live camera and microphone access, location tracking, SMS and one-time-code interception, keylogging, banking overlays and crypto-wallet address swapping. Its dashboards showed devices reporting from several countries, including India and the US.
- Made publicNothing to patch
iVerify says it first observed the developer's activity behind ZeroDayRAT, a spyware platform sold openly through Telegram sales, support and update channels.
Sources
- Breaking down ZeroDayRAT: new spyware targeting Android and iOSiVerify · 10 Feb 2026
- New Mobile Spyware ZeroDayRAT Targets Android and iOSInfosecurity Magazine · 10 Feb 2026