Telegram-Marketed Mobile RATs Sold as MaaS Target Android (and Claimed iOS) via Smishing and Surveillance Features

Researchers reported two Telegram-marketed malware-as-a-service (MaaS) offerings focused on mobile device compromise and surveillance. ZeroDayRAT is advertised as a subscription spyware platform claiming full monitoring of Android and iOS devices, with infections driven by smishing and other social-engineering lures that push victims to malicious links disguised as legitimate apps/updates; delivery chains reportedly use multi-stage redirects, URL shorteners, and in some cases trusted hosting such as GitHub Pages to evade reputation-based filtering. Once installed, the operator-facing web panel is advertised to provide extensive monitoring, including device profiling, app-usage timelines, GPS tracking, and remote activation of camera/microphone, plus screen recording and keystroke logging—capabilities consistent with credential theft and broad user surveillance.

Separately, Cyble detailed ongoing development of SURXRAT (marketed as SURXRAT V5) as an Android RAT sold through a structured reseller/partner licensing model that enables affiliates to generate customized builds while the operator retains centralized control. The malware is described as a full-featured surveillance and device-control toolkit that abuses Android Accessibility permissions for persistent control and uses Firebase-backed C2; code similarities indicate lineage from ArsinkRAT. Recent samples were observed conditionally downloading a large LLM module from Hugging Face, which researchers assess as experimentation that could enable AI-assisted functionality, deliberate device performance impact, or new monetization approaches alongside established behaviors such as data exfiltration, remote command execution, and ransomware-style device locking.