The concept "zero-day malware" was used for many years, but as
@Lockdown mentioned, in the context of exploits. At present it is accepted to use it in the context of general malware:
"Zero-day
malware is hostile computer
software, such as viruses or
Trojan horses, that is not yet detectable by antivirus programs. "
Advanced persistent threat | information technology
Yet, the term "zero-day attack", seems to be realated only to exploits.
Sometimes it is hard to understand the meaning of "zero-day malware" terminology:
"Mark Russinovich
WORKSHOP - Zero Day Malware Cleaning with the Sysinternals Tools
Learn how to analyze and clean
zero day malware using the Sysinternals tools directly from their author, including Process Monitor, Process Explorer, and Autoruns. By enabling deep inspection and control of processes, file system and registry activity, and autostart execution points, these utilities are useful for everything from day-to-day computer maintenance to advanced system and application troubleshooting. The tools are especially effective for
malware analysis and cleaning - so much so that malware commonly tries to prevent their execution. Mark focuses on the features useful for
malware hunting, demonstrates their capabilities by presenting real-world cases of the tools being used to identify and clean malware, and concludes with a live analysis of the infamous
Stuxnet virus."
Black Hat ® Technical Security Conference: USA 2011 // Venue
It seems first that the above is related to the undetected, general malware samples, except the Stuxnet virus example, which is known for exploiting many zero day vulnerabilities.
