Advanced Remote Access Trojan Eliminates Need for APK or IPA to Hijack Phones

A remote access Trojan (RAT) has evolved steadily from opportunistic malware to highly controlled instruments of digital intrusion in the evolving landscape of cyber threats as they have evolved from opportunistic malware. These programs are designed to create a concealed backdoor within a targeted computer system, allowing attackers to gain administrative access without being noticed by the user. 

A RAT is a piece of software that is often infiltrated with deception to gain access, embedded within seemingly legitimate applications, such as games and innocuous email attachments. When executed, they operate silently in the background, turning the compromised device into an accessible endpoint remotely.

Through this foothold, threat actors have the ability to continue monitoring and controlling infected systems, as well as spreading the malware to multiple infected systems, resulting in coordinated botnets.

As a result of their widespread use through exploit frameworks such as Metasploit, modern RATs are designed for efficiency and resilience. They establish direct communication channels with command-and-control servers through defined network ports, ensuring uninterrupted access and control of an infected environment. 

ZeroDayRAT signals an escalation of commercialization and accessibility of advanced mobile surveillance capabilities, building on this established threat model. Researchers at iVerify identified and examined the toolkit in February 2026, which was positioned not as a niche exploit but rather as a fully developed spyware offering distributed through Telegram channels. 

As opposed to traditional RAT deployments that often require a degree of technical proficiency, ZeroDayRAT enables operators to deploy the program without any technical knowledge by providing them with streamlined infrastructure, such as dedicated command servers, preconfigured malicious application builders, and intuitive user interfaces.

With the combination of operational simplicity and capabilities commonly associated with state-sponsored tooling, attackers are able to control Android and iOS devices comprehensively.

When the malware has been deployed, commonly through smishing campaigns, phishing emails, counterfeit applications, or weaponized links shared across messaging platforms, it establishes persistent access to the target system and begins gathering data about the device. 

Operator dashboards aggregate critical data points, such as device specifications, operating system information, battery metrics, location, SIM and carrier details, application usage patterns, and SMS fragments, enabling continuous behavioral profiling.

With this level of control, attackers can utilize real-time and historical GPS tracking, intercept notifications across applications, and observe incoming communications and missed interactions without direct user engagement to further extend their control. By doing so, they maintain a deep yet unobtrusive presence within the compromised device ecosystem. 

A parallel and equally worrying trend aligns closely with this operational model: a proliferation of fraudulent mobile applications posing as legitimate brands in large numbers. The development and maintenance of authentic applications remains a priority for organizations; however, adversaries are increasingly taking advantage of this trust by distributing nearly perfect replicas across multiple channels for app distribution. 

Content was cut in order to protect the source.Please visit the source for the rest of the article.