Loading story…
Technical investigations of Intellexa/Cytrox’s Predator spyware reveal sophisticated methods for defeating mobile security boundaries on iOS and Android. iVerify analyzed a 2023 iOS loader, obtained in 2024, that replaced an earlier Python implementation with native code and was associated with an actively exploited chain combining Safari remote code execution, kernel privilege escalation, and a CoreTrust certificate-validation bypass. Apple patched the chain in September 2023. The loader downloads and supervises additional binaries through watcher and helper modes, provides interprocess services, and supports surveillance-related hooks; researchers found no persistence module in the analyzed loader.
Cisco Talos found that Predator’s Android implant relies on tightly integrated ALIEN and PREDATOR components, using privileged-process injection and binder and audio hooks to enable call and VoIP recording, arbitrary code execution, application-data theft, and certificate installation for user-level TLS interception. Talos assessed that the previously reported 2021 infection chain likely used CVE-2021-1048 for privilege escalation, while additional suspected components remained unavailable for analysis. On iOS, dynamically configured process names and domains complicate detection, and identified temporary-file indicators do not survive in backups. Security teams should prioritize current mobile patches and timely specialist forensic collection for suspected infections, because ordinary iOS security applications cannot access much of the required telemetry.
See which actors are running it and whether you're in range.
12 events from the most recent confirmed update back to the earliest known activity.
iVerify obtained a Predator loader sample rather than the complete spyware implant. Researchers used it to compare the 2023 native implementation with the 2021 Python-based version.
Apple released iOS 16.7 and 17.0.1 to patch CVE-2023-41991, CVE-2023-41992, and CVE-2023-41993, with Intellexa attribution reported by Citizen Lab and Google TAG. The Predator-associated chain combined a CoreTrust certificate-validation bypass, kernel privilege escalation, and Safari remote code execution.
The analyzed 2023 Predator loader contained a signing timestamp of September 7, 2023, at 23:11:15 and an apparent copy of a legitimate App Store application's signature. Unlike the earlier Python-based version, this Watcher loader was written in native code and compiled for arm64e.
A U.S. executive order restricted government use of commercial spyware posing security risks. Talos referenced the order in its analysis of the mercenary spyware ecosystem surrounding Intellexa.
Predator's 2021 iOS version infected devices through an infection URL opened in Safari and used shortcuts as a persistence mechanism. The implementation was primarily Python-based and bundled its own Python environment.
A 2021 exploit chain used to deliver ALIEN involved four Chrome vulnerabilities and CVE-2021-1048 in Linux and Android. Talos later identified ALIEN as an integrated component that establishes low-level capabilities for PREDATOR.
The Linux kernel vulnerability was patched, although the report notes that some Android devices remained vulnerable into 2021.
The Linux kernel vulnerability later tracked as CVE-2021-1048 became public. Cisco Talos subsequently assessed that Predator's QUAILEGGS privilege-escalation method likely exploited this vulnerability.
iVerify detailed the loader's watcher and helper modes, surveillance-related hooks, temporary-file indicators, and diagnostic log strings. Researchers found no persistence module in the analyzed loader and no identified indicators that would survive in an iOS backup, emphasizing the importance of timely forensic telemetry.
Russian threat actors targeting Mongolia subsequently reused CVE-2023-41993, the Safari remote code-execution vulnerability associated with the Predator exploit chain.
CVE-2023-41991, the CoreTrust certificate-validation vulnerability used in the Predator-associated exploit chain, was subsequently incorporated into TrollStore v2.
Cisco Talos published a technical analysis showing that ALIEN is more than a loader and works closely with PREDATOR to establish privileged surveillance capabilities. The research detailed audio recording, application data theft, certificate installation, and additional suspected components named tcore and kmem.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
3 references tracked. Mallory keeps watching after this page renders.
iverify.io
Open sourcesentinelone.com
Open sourceblog.talosintelligence.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
New reverse-engineering by **Jamf Threat Labs** of an iOS **Predator** commercial spyware sample found previously undocumented anti-analysis and “deployment troubleshooting” capabilities that help operators understand *why* an infection attempt failed. The analysis describes an internal **error-code taxonomy** that reports specific failure conditions back to Predator’s command-and-control infrastructure, including `error code 304` indicating the target device is running security or analysis tooling; Jamf assessed this turns failed deployments into actionable diagnostic events for operators rather than opaque failures. Jamf also reported additional stealth and evasion features, including suppression of crash artifacts and mechanisms intended to hinder researcher analysis and user detection. Reported capabilities include checks for tools such as **Frida** and even utilities like `netstat`, suggesting Predator attempts to detect both professional analysis environments and privacy-conscious user behavior. Dark Reading highlighted that these telemetry and reporting behaviors imply **Intellexa** (Predator’s vendor) may have more visibility into, and potential control over, deployments than commercial spyware vendors typically claim, and noted other technical elements Jamf described such as crash reporting/monitoring and iOS *SpringBoard* hooking intended to conceal recording indicators.
Jun 29, 2026
**Jamf Threat Labs** reverse-engineered *Intellexa/Cytrox Predator* iOS spyware and documented how it defeats Apple’s iOS 14+ privacy indicators (green dot for camera, orange dot for microphone) while conducting covert surveillance. The analysis describes a **post-compromise** capability (not a new iOS vulnerability): Predator requires a device to already be fully compromised, including **kernel-level access** and the ability to inject code into system processes, after which it can silently stream camera and microphone feeds without triggering the on-screen indicators. Technically, Jamf found Predator uses a **single SpringBoard hook** (e.g., `HiddenDot::setupHook()`) to intercept sensor-activity updates before they reach the UI, targeting the method `_handleNewDomainData:` associated with `SBSensorActivityDataProvider`. By nullifying or suppressing the object/updates responsible for indicator state changes (including via Objective-C `nil` messaging behavior), Predator prevents the indicator dots from ever lighting up. Reporting on the research, *BleepingComputer* highlighted that the mechanism does not exploit an iOS flaw itself, but leverages previously obtained privileged access; Jamf also noted an operational limitation where **VoIP recording** may not have the same built-in stealth capability as the camera/microphone indicator bypass.
Jun 29, 2026
Google's Threat Analysis Group said **Cytrox's Predator spyware** was deployed in three 2021 campaigns that chained **five zero-day vulnerabilities** across **Chrome** and **Android** to compromise fully updated Android devices, including Samsung phones. The attacks used one-time spear-phishing links sent by email, redirected victims through attacker-controlled domains, and then forwarded them to legitimate websites after exploitation. Google said the exploit chains included Chrome sandbox escapes, Android privilege-escalation flaws, and in some cases a Samsung browser pivot, allowing operators to install the **Alien** malware first and then load the **Predator** implant. Google assessed with high confidence that Cytrox, a North Macedonian spyware vendor, packaged the exploits and sold them to multiple government-backed customers linked to **Egypt, Armenia, Greece, Madagascar, Côte d'Ivoire, Serbia, Spain, and Indonesia**. The campaigns were described as limited in scale, targeting only tens of users, but the spyware gave operators extensive surveillance access, including the ability to record audio, add CA certificates, and hide apps. Google's findings aligned with earlier **Citizen Lab** reporting that identified Predator on the phone of exiled Egyptian politician **Ayman Nour**, underscoring the growing commercial market for mercenary spyware and delayed patching risks such as **CVE-2021-1048**.
Aug 15, 2026