Predator Spyware Evades iOS Defenses
Executive Summary
Intellexa’s Predator spyware continues to target high-profile iOS users (journalists, politicians) with severe, kernel-level surveillance capabilities.
Recent forensic analysis confirms the malware’s ability to proactively defeat Apple’s hardware-linked privacy indicators (the orange and green dots) to covertly capture ambient audio and video without alerting the user.
Key TTPs
- Initial Access: Deployment relies heavily on targeted one-click SMS/WhatsApp social engineering, alongside sophisticated "strategic" zero-click vectors. These zero-click methodologies include the "Aladdin" vector, which silently exploits vulnerabilities in third-party mobile ad-rendering engines, and the "Mars/Jupiter" vectors, which utilize ISP-level Adversary-in-the-Middle (AitM) network injection.
- Execution & Privilege Escalation: The malware utilizes continuously replenished zero-day exploit chains targeting mobile browsers and the underlying iOS operating system to achieve remote code execution, break out of the browser sandbox, and escalate privileges.
- Defense Evasion: To suppress iOS privacy indicators, Predator uses cross-process injection into the SpringBoard process via Mach exceptions. It installs a highly efficient hook (HiddenDot::setupHook()) targeting the SBSensorActivityDataProvider class. By exploiting Objective-C's nil messaging behavior during the _handleNewDomainData: method call, it nullifies the object, causing the OS to quietly discard sensor activation alerts without crashing.
- Anti-Forensics: Predator actively monitors the /private/var/mobile/Library/Logs/CrashReporter directory. If an exploitation-related memory fault is detected, it issues a SIGKILL command directly to the mmaintenanced (memory maintenance) daemon, forcefully terminating it to destroy incriminating crash logs before they are saved.
Targeting & Infrastructure
- Target Profile: Civil society members, human rights defenders, journalists, and political opposition figures.
- Infrastructure: Despite heavy US OFAC sanctions, Intellexa's Tier 5 infrastructure nodes remain active. Current network telemetry links ongoing Predator operations to sovereign clients in Saudi Arabia, Kazakhstan, Angola, and Mongolia.
Relevant Terms
- Objective-C Nil Messaging: A fundamental characteristic of the Objective-C runtime where sending a message to a null pointer is silently ignored rather than causing a fatal application crash, allowing for stealthy UI manipulation.
- SpringBoard: The highly privileged core iOS process responsible for managing the home screen, launching applications, and strictly controlling user interface elements, including status bar sensor indicators.
Source: BleepingComputer