Tech News
← Back to articles

Gnarly new Android spyware could let attackers track your location, steal banking info

read original related products more articles

Mishaal Rahman / Android Authority

TL;DR A newly described malware toolkit provides attackers deep access to device and personal information.

The spyware is being distributed through Telegram and requires Android targets to install a malicious APK.

Android devices running versions 5 through 16 can be affected.

There’s a nasty new spyware worry about on Android. ZeroDayRAT is a spyware toolkit being distributed through Telegram, allowing deep access to targeted devices without much technical knowledge required.

A report published today by mobile research company iVerify breaks down the ZeroDayRAT threat. According to the report, the exploit is being sold through Telegram, seemingly since last week. It gives bad actors access to a wide variety of sensitive information, and can be leveraged against target devices running Android, from version 5.0 Lollipop all the way to today’s Android 16.

Don’t want to miss the best from Android Authority? Set us as a favorite source in Google Discover to never miss our latest exclusive reports, expert analysis, and much more.

to never miss our latest exclusive reports, expert analysis, and much more. You can also set us as a preferred source in Google Search by clicking the button below.

The ZeroDayRAT toolkit for Android comprises a malicious APK that infects devices and a dashboard that provides deep insight into the data on those infected devices. Once the APK has been installed, the dashboard provides access to device information including model, operating system, phone number, SIM info, and more. It can also reveal which apps are installed on the device, as well as a log of all incoming notifications.

Even more alarmingly, ZeroDayRAT allows bad actors to track targets’ locations in real time; view info for all accounts registered on target devices; and read SMS messages, including OTP codes. The kit allows attackers real-time access to live camera and microphone feeds, and even a live-streamed view of what a user is doing on their screen at any given time.

... continue reading