The ZeroDayRAT malware was sold on Telegram.

ZeroDayRAT malware is sold on Telegram, hackers say. It can spy on prey in real time.

A type of malware that in the latter period has long been popular with hackers will not escape the remote access trojan type of malware that has developed almost constantly, as in this news.

According to a report by The Hacker News website, a new RAT type of malware named ZeroDayRAT has been detected on the channel of the popular chat service Telegram as malware for rental, or MaaS (Malware-as-a-Service). A research team from iVerify, a mobile phone security engine developer, said that a group of hackers who developed the malware advertised that the malware could be used on mobile phones using Android operating systems from versions 5 to 16 and iOS all versions to version 26.

In spreading this malware, it is the use of social engineering deception or the creation of fake applications on the fake application marketplace. This malware package comes with a builder to help create malware installers and online control panels to create servers to market fake apps and conveniently upload fake app files. In addition, some hackers using it have successfully spread malware adulterated applications through official app stores such as the Google Play Store and the Apple App Store. Also.

After the victim's machine has installed a fake application with malware, hackers using this malware will see all the details of the machine, covering machine model, location, operating system, battery state, SIM (SIM), machine details, active apps, notifications, SMS Preview via the malware control panel. This location tracking will be compatible with GPS with the Google Map map with precision. In addition to the Account on the malware control panel. It displays accounts that use various applications. It displays both the Username and the email used to register the application service. It covers Google, WhatsApp, Instagram, Facebook, Telegram, Amazon, Flipkart, PhonePe, Paytm, Spotify, and many others.

Malware also has the ability to steal a wide range of data - Keystroke, Short Message (SMS or Short Message Service) - covering OTP or One-Time Password, as well as allowing active hackers to spy on victims in real-time via cameras and microphones on the victim's mobile phone, stream directly to the malware control panel so that hackers can keep a close eye on the victim, and even worse, the malware has also implemented the feature of the victim's data theft type malware or Infostealer to steal the data of the KriptoK wallet. Various Crypto Wallet, such as MetaMask, Trust Wallet, Binance, and Coinbase, can convert the Clipboard address to hackers instead. The victim transfers the wrong money to hackers instead.

Even worse, malware also has the ability to steal money from bank accounts or Banking Trojan to steal money from mobile wallets or mobile wallets, such as Apple Pay, Google Pay, PayPal, and PhonePe. It can steal money by Instant Money Transfer via the Unified Payments Interface (UPI) protocol, which makes it a Peer-to-Peer transfer or a Person-to-Merchant transfer.

The research team also discovered that the hacker team behind the development and distribution of this malware has created a very good distribution channel with sales, customer service and regular updates. It is always like a professional software development company, but the malware detection team does not specify the price and conditions of use of the malware.

3/17 Edited to