The ZeroDayRAT spyware toolkit can let attackers track location, view live camera feeds, and steal baking credentials on Android and iOS.