ZeroDayRAT and Webloc: The New Frontier of Mobile Surveillance and Ad-Tech Interception

The Emergence of ZeroDayRAT: Commercializing Total Device Control\n\nZeroDayRAT is a newly identified cross-platform mobile malware platform that provides full remote access to Android and iOS devices via a Telegram-based distribution model. First observed in early February 2026, this tool represents a significant shift in the accessibility of high-end cellphone spyware. Unlike traditional state-sponsored tools that require multi-million dollar contracts, ZeroDayRAT is sold openly on encrypted messaging platforms, offering a sophisticated C2 dashboard to a broader range of threat actors. \n\nThe technical capabilities of ZeroDayRAT are extensive. Once a device is compromised, the operator gains the ability to enumerate all registered accounts, including Google, WhatsApp, and Telegram. The spyware captures real-time notifications, allowing attackers to read incoming messages from encrypted communications apps before they are even opened by the user. Furthermore, the platform includes a dedicated GPS tracking module that plots location history on an embedded map, providing a granular view of the target's movements. This level of access effectively turns the mobile device into a 24/7 mobile surveillance beacon, bypassing standard OS-level privacy protections through deep system integration.\n\n## Webloc and the Weaponization of Global Ad-Tech Data\n\nWebloc is an advertising-based global geolocation surveillance system that has recently been attributed to use by various international intelligence and law enforcement agencies. According to research from Citizen Lab, Webloc has been used to track upwards of 500 million devices worldwide by exploiting the digital advertising ecosystem. This method of cellular interception is particularly insidious because it does not require the installation of traditional mobile malware. Instead, it harvests "bidstream" data—the information exchanged between advertisers and apps during the real-time bidding process for ad placements.\n\nBy aggregating this data, Webloc allows state actors to perform mass mobile surveillance without ever interacting with the target's device. This bypasses the security benefits of encrypted phones that focus solely on hardening the operating system against exploits. For corporate and investigative professionals, the existence of Webloc underscores a critical vulnerability: the apps we trust for daily productivity are often the primary source of our own surveillance. This data leakage occurs at the network level, making it nearly impossible to detect through standard on-device security software. Protecting against such threats requires a comprehensive approach to data privacy, including the use of encrypted communications protocols that mask metadata and the minimization of third-party app footprints.\n\n## The Coruna Exploit Kit: Evolution of iOS Kernel Attacks\n\nThe discovery of the "Coruna" iOS exploit kit highlights the persistent danger of zero-click vulnerabilities in modern mobile ecosystems. Coruna is a sophisticated framework containing 23 distinct exploits, designed to compromise even fully updated iOS devices. Technical analysis reveals that Coruna is an evolution of the code used in the 2023 "Operation Triangulation" campaign, suggesting a continuous development cycle by advanced threat actors. These exploits often target the iOS kernel, the core of the operating system, to gain unfettered access to the device's hardware and data.\n\nOne of the most concerning aspects of Coruna is its ability to bypass "BlastDoor," the sandbox security feature introduced by Apple to protect iMessage from malicious payloads. By utilizing a chain of vulnerabilities—including a recently disclosed VPU (Video Processing Unit) driver flaw—attackers can achieve kernel read/write capabilities. This allows for the persistent installation of cellphone spyware that can survive system reboots. For high-risk individuals, this level of sophistication makes software-based defenses alone insufficient. Many are now turning to hardware-modified phones that incorporate physical disconnects for the camera, microphone, and wireless radios, providing a definitive layer of protection against hardware surveillance that software cannot override.\n\n## Mobile Forensics and the Challenge of Modern Detection\n\nAs mobile surveillance technology becomes more evasive, the field of mobile forensics must adapt to detect increasingly stealthy indicators of compromise (IoCs). Traditional forensic tools, such as those produced by Cellebrite, are frequently used by law enforcement to extract data from seized devices, but they are also being used in more controversial contexts to target activists and journalists. The arms race between forensic extraction and device encryption has led to the development of more robust encrypted phones that utilize multi-layered encryption and secure enclaves to protect user data.\n\nHowever, detecting zero-click infections like ZeroDayRAT or Coruna requires more than just data protection; it requires active memory analysis and the monitoring of system-level anomalies. Modern mobile forensics now involves looking for unauthorized modifications to the kernel or unusual data exfiltration patterns to a C2 dashboard. For organizations, the deployment of mobile Endpoint Detection and Response (mEDR) solutions is becoming a necessity. These tools provide the visibility needed to identify mobile malware in real-time, offering a critical defense against the commercialized spyware kits that are now readily available to a wide array of adversaries.\n\n## Key Takeaway\n\nThe mobile threat landscape is currently defined by the dual threats of commercialized cellphone spyware like ZeroDayRAT and mass-scale ad-tech exploitation via systems like Webloc. While encrypted communications remain a cornerstone of digital privacy, they are increasingly targeted by zero-click exploits that compromise the device at the kernel level. To maintain security in this environment, professionals must move beyond standard consumer devices and consider hardware-modified phones and advanced mobile forensics strategies. The integration of physical security measures with robust encryption is the only viable path forward in an era where surveillance is both a commodity and a state-level weapon.\n\nNote: This analysis is intended for educational and professional compliance purposes; the use of surveillance technology is subject to strict international and local legal frameworks.