Hackers Hit Android and iPhone Users’ Bank Accounts, Launch Mobile Spyware Platform Triggering Total Device Takeover

Hackers have launched a sophisticated mobile spyware platform that triggers a total compromise of Android and iOS devices.

Researchers at iVerify say the platform is called ZeroDayRAT and is currently for sale on Telegram.

It gives criminals a powerful web dashboard to seize full control of phones running Android 5 through 16 or iOS up to version 26, including the new iPhone 17 Pro.

The spyware grabs everything including live GPS location with history, every notification from WhatsApp to banking and crypto apps, full lists of accounts on the device and the ability to read and send SMS, including one-time passwords that defeat two-factor protection.

Researcher Daniel Kelley tells SecurityWeek that the platform is essentially decentralized, with no central server for authorities to track. The spyware is advertised in Portuguese, Russian, Chinese, Spanish, and English.

“We’ve seen them post messages in Chinese, use a Russian domain, and target Indian victims…

The crypto stealer runs clipboard injection continuously, so theft happens whenever the victim tries to send funds. Unexplained outbound transactions to addresses victims don’t recognize would be a red flag.

The bank stealer goes after credentials rather than initiating transfers directly. There would be unauthorized logins. But by the time it shows up in financial records, the damage is done.”

The malware is deployed when victims click malicious links via smishing texts, phishing emails, fake app stores and links shared on WhatsApp and Telegram. To help stay secure, researchers recommend users never tap unsolicited links and ensure they download apps only from official stores.

Generated Image: Midjourney