Loading malware…
Predator is commercial mobile spyware developed by Cytrox and associated with the Intellexa consortium. It targets Android and iOS devices and is supplied to government-backed customers for targeted surveillance. Documented targets include journalists, opposition politicians, lawyers, intelligence personnel, and European institutional figures. It is distinct from the unrelated Windows information stealer Predator the Thief.
Predator infection chains exploit browser and operating-system vulnerabilities to obtain code execution, escape sandboxes, and escalate privileges. Documented delivery includes targeted email and SMS messages containing malicious links; advertising-based zero-click delivery has also been documented as part of its surveillance ecosystem. Android campaigns in 2021 used one-time links that delivered exploits before redirecting victims to legitimate websites. These operations deployed Alien as a precursor to loading Predator and targeted small numbers of users, including devices that were fully updated at the time.
Predator supports covert surveillance, including audio and VoIP recording, camera-related functionality, and keylogging-related operations. Its Android deployment architecture supports certificate installation and application concealment. Anti-forensic behavior includes crash-log removal and concealment of execution parameters. Its exploitation chains have included kernel privilege escalation and code-signing validation bypasses.
Early iOS versions were primarily Python-based and used Shortcuts for persistence. A 2023 iOS loader was rewritten in native code and operated in watcher and helper modes to download, execute, supervise, and restore additional components. It also exposed interprocess services and kernel-memory access to other components. No persistence module was identified in that particular loader, so persistence mechanisms should not be assumed to be uniform across versions. Limited mobile telemetry and the removal or short lifetime of forensic artifacts complicate detection and retrospective investigation.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
12 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
CVE-2023-41991, CVE-2023-41992, and CVE-2023-41993 (Apple iOS) — Intellexa/Cytrox (Predator).
CVE-2023-3079 (Google Chrome) — Intellexa/Cytrox (Predator).
Apple patched three vulnerabilities exploited in the wild on September 21, 2023, including “CVE-2023-41991 - Certificate validation issue (CoreTrust).” The CoreTrust vulnerability subsequently appeared in TrollStore v2.
CVE-2023-2033 (Google Chrome) — Intellexa/Cytrox (Predator).
CVE-2023-2136 (Google Chrome) — Intellexa/Cytrox (Predator).
CVE-2023-41991, CVE-2023-41992, and CVE-2023-41993 (Apple iOS) — Intellexa/Cytrox (Predator).
The five previously unknown 0-day security vulnerabilities used in these campaigns include: CVE-2021-37973, CVE-2021-37976, CVE-2021-38000, CVE-2021-38003 in Chrome and CVE-2021-1048 in Android. Campaign #3 - Full Android 0-day exploit chain (CVE-2021-38003, CVE-2021-1048). | state-backed threat actors used five zero-day vulnerabilities to install Predator spyware developed by commercial surveillance developer Cytrox.
The five previously unknown 0-day security vulnerabilities used in these campaigns include: CVE-2021-37973, CVE-2021-37976, CVE-2021-38000, CVE-2021-38003 in Chrome and CVE-2021-1048 in Android. Campaign #2 - Chrome sandbox escape (CVE-2021-37973, CVE-2021-37976). | state-backed threat actors used five zero-day vulnerabilities to install Predator spyware developed by commercial surveillance developer Cytrox.
The five previously unknown 0-day security vulnerabilities used in these campaigns include: CVE-2021-37973, CVE-2021-37976, CVE-2021-38000, CVE-2021-38003 in Chrome and CVE-2021-1048 in Android. Campaign #3 - Full Android 0-day exploit chain (CVE-2021-38003, CVE-2021-1048). | state-backed threat actors used five zero-day vulnerabilities to install Predator spyware developed by commercial surveillance developer Cytrox.
The five previously unknown 0-day security vulnerabilities used in these campaigns include: CVE-2021-37973, CVE-2021-37976, CVE-2021-38000, CVE-2021-38003 in Chrome and CVE-2021-1048 in Android. Campaign #2 - Chrome sandbox escape (CVE-2021-37973, CVE-2021-37976). | state-backed threat actors used five zero-day vulnerabilities to install Predator spyware developed by commercial surveillance developer Cytrox.
The five previously unknown 0-day security vulnerabilities used in these campaigns include: CVE-2021-37973, CVE-2021-37976, CVE-2021-38000, CVE-2021-38003 in Chrome and CVE-2021-1048 in Android. Campaign #1 - redirecting to SBrowser from Chrome (CVE-2021-38000). | state-backed threat actors used five zero-day vulnerabilities to install Predator spyware developed by commercial surveillance developer Cytrox.
"Intellexa’s Predator spyware can suppress Apple’s built-in camera and microphone indicators on compromised devices."
3 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
“Leaks show Intellexa burning zero-days to keep Predator spyware running”
The commercial surveillance company is the maker of Predator, an implant analogous to that of NSO Group's Pegasus, and is known to have developed tools that enables its clients to penetrate iOS and Android devices.
Predator is a sophisticated mercenary spyware targeting both Android and iPhone devices and has been active since at least 2019.
32 distinct techniques documented for this family, organized by ATT&CK tactic.
Gjurmë të Predator u gjetën më vonë në dhjetëra telefona.
Once clicked, the link redirected the target to an attacker-owned domain that delivered the exploits before redirecting the browser to a legitimate website.
at least 87 high-profile Greeks were targeted by Predator spyware via hundreds of SMS messages containing malicious links that exploited Chrome and Android zero-day vulnerabilities
at least 87 high-profile Greeks were targeted by Predator spyware via hundreds of SMS messages containing malicious links
All three campaigns delivered one-time links mimicking URL shortener services to the targeted Android users via email.
powershell.exe -Command "[void][Windows.Security.Credentials.PasswordVault...
state-backed threat actors used five zero-day vulnerabilities to install Predator spyware... the attackers used zero-day exploits targeting Chrome and the Android OS to install Predator spyware implants on fully up-to-date Android devices.
compromise the system by injecting malicious code into privileged processes
Campaign #3 - Full Android 0-day exploit chain (CVE-2021-38003, CVE-2021-1048)
involved an exploit chain using CVE-2021-37973 and CVE-2021-37976 to escape the Chrome sandbox
Stealth - техники уровня Rootkit (T1014) для сокрытия артефактов ниже уровня ОС.
Predator’s owners decided to obfuscate most of its code with a number of simple techniques. XOR, Base64, Substitutions, Stack strings and more are being used to hide API methods, Folder paths, Register keys, the C2 server/Admin panel and so on.
Маскировка (T1036, Masquerading) Скрытие иконки, имя «System Service» Инъекция в легитимные процессы
compromise the system by injecting malicious code into privileged processes
Apple также сделала BlastDoor - механизм изоляции и валидации недоверенного контента в сообщениях до его попадания в чувствительные части системы. Это повышает стоимость разработки reliable spyware для iPhone.
Anti-debugging/sandbox checks Predator retains its old techniques for sandbox evasion... a hardcoded list of DLLs that are checked if loaded into memory
One old trick, for example, that survived the version update is the check of Graphic Card Name introduced in v2.x.x.
allowing recording audio, adding CA certificates, and hiding apps
Stalkerware скрывает иконку из launcher (T1564.001, Hidden Files and Directories), но остаётся видимым в Settings -> Apps -> Show all apps и в выводе adb shell pm list packages -3
is engineered to record audio, add CA certificates, and hide apps to evade detection
Collection - имплант активирует Keylogging (T1056.001), Screen Capture (T1113), Audio Capture (T1123), Video Capture (T1125).
In previous versions, Predator usually uses a temporary file (*.col format file) to store browser content (in an SQLite3 database)
for Edge and IE it was replaced with a hardcoded PowerShell command... [Windows.Security.Credentials.PasswordVault]... RetrieveAll() ... UserName, Password, Resource
Anti-debugging/sandbox checks Predator retains its old techniques for sandbox evasion... a hardcoded list of DLLs that are checked if loaded into memory
One old trick, for example, that survived the version update is the check of Graphic Card Name introduced in v2.x.x.
Predator is a data stealer... supports the following list of browser data theft... Location, Games, FTP, VPN, 2FA, Messengers, Webcam, HWID, Clipboard, Specific document files (Grabber), Project filenames, Browsers IE/Edge.
Collection - имплант активирует Keylogging (T1056.001), Screen Capture (T1113), Audio Capture (T1123), Video Capture (T1125).
Collection - имплант активирует Keylogging (T1056.001), Screen Capture (T1113), Audio Capture (T1123), Video Capture (T1125).
The behavior we captured is clearly that of a clipboard stealer. The functionality includes a crawler that checks if the clipboard contains data, grabs it and places it in a dedicated file
allowing recording audio, adding CA certificates, and hiding apps
Collection - имплант активирует Keylogging (T1056.001), Screen Capture (T1113), Audio Capture (T1123), Video Capture (T1125).
...“shkeljen e paligjshme të jetës së tyre private, konfidencialitetit të komunikimeve të tyre dhe të dhënave të tyre personale”...
the screenshot was transferred to a C2 using a stealer dubbed ‘Predator’... the owners are only selling the builder... optional service to help the customer install the C&C... IP/Domains
the attackers first installed the Android Alien banking trojan with RAT functionality used to load the Predator Android implant
C2 - Encrypted Channel (T1573) через HTTPS с certificate pinning.
Exfiltration - Exfiltration Over C2 Channel (T1041) порциями в ночное время.
773 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
140 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Spyware mentioned as a comparison to the Candiru attacks. Its advertisement-based, zero-click delivery mechanism, called Aladdin, was documented through leaked Intellexa materials corroborated by forensic investigations.
Mentioned as spyware associated with Intellexa in background about Discover-Tech's corporate connections. The content does not establish that Predator was delivered through Controlium or used in the Al Jazeera compromises.
Commercial spyware associated with Intellexa, mentioned only as a headline in a list of malware-news items.
Commercial mobile spyware mentioned as a comparison for the zero-click, radio-layer exploitation profile; it is not identified as exploiting CVE-2026-58704.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.