Predator Spyware iOS SpringBoard Hook — Intellexa Recording Indicator Bypass via Kernel-Level Sensor Interception
Predator Spyware iOS SpringBoard Hook (TL-2026-0132), also tracked as Predator, is a high-severity malware campaign, first published 2026-02-22. It is attributed to Intellexa Consortium (Israel) with high confidence, affects Apple iOS, maps to 30 MITRE ATT&CK techniques (T1014, T1027, T1037), and is covered by 9 detection rules and 16 indicators of compromise.
Key facts for TL-2026-0132
- Threat ID
- TL-2026-0132
- Also known as
- Predator, HiddenDot, PREYHUNTER, DMHooker
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-02-22
- Last reviewed
- 2026-02-22
- Attribution
- Intellexa Consortium
- Attribution confidence
- HIGH
- Nation-state nexus
- Israel
- Motivation
- ESPIONAGE
- Target sectors
- government, journalism, human-rights, civil-society, diplomacy, legal, political-opposition
- Target regions
- Global, Middle East, North Africa, Europe, South Asia, Southeast Asia
- Detection rules
- 9
- Indicators of compromise
- 16
Malware and tooling in Predator Spyware iOS SpringBoard Hook
Malware and tooling: Predator
Jamf Threat Labs published first detailed technical analysis of how Intellexa's US-sanctioned Predator spyware suppresses iOS camera and microphone recording indicators (green/orange dots). Using kernel-level access, Predator hooks SpringBoard's SBSensorActivityDataProvider._handleNewDomainData: method, nullifying the sensor data object via Objective-C nil messaging to silently drop all indicator updates. A single hook defeats both camera and microphone indicators simultaneously.
How Predator Spyware iOS SpringBoard Hook works
Jamf Threat Labs researchers Nir Avraham and Hu Ke published technical analysis on February 19, 2026 documenting how Intellexa's Predator spyware defeats iOS recording privacy indicators — the green (camera) and orange (microphone) dots Apple introduced in iOS 14.
## Technical Mechanism
Predator uses a single hook function (HiddenDot::setupHook()) inside SpringBoard, iOS's home screen and UI controller process. The hook targets SBSensorActivityDataProvider._handleNewDomainData:, which is called by iOS whenever sensor activity changes (camera activation, microphone activation). By intercepting this single method, Predator blocks ALL sensor status updates before they reach the indicator display system.
The suppression mechanism exploits a fundamental feature of Objective-C: messages sent to nil are silently ignored. At the ARM64 assembly level, a single STR XZR instruction writes zero to the thread state, setting the self pointer (x0 register) to NULL. When the hooked method executes, the call becomes [nil _handleNewDomainData:newData], which returns nil/0 without executing any code. SpringBoard never learns that the camera or microphone became active.
The hook callback returns value 2, which in DMHooker's exception-based hooking system means "continue execution with the modified thread state."
## Key Finding: Single Hook, Dual Suppression
SBSensorActivityDataProvider aggregates ALL sensor activity before dispatching to the UI layer. By intercepting _handleNewDomainData:, this single hook disables both camera AND microphone indicators simultaneously — more efficient than the abandoned alternative found in dead code (CSWatcherSpawner::TestHooker()) that would have required separate hooks for SBRecordingIndicatorManager.
## Camera Access: PAC Bypass
A separate CameraEnabler module uses ARM64 instruction pattern matching (via memmem()) to locate internal camera functions near FigVideoCaptureSourceCreateWithSourceInfo. The callback conditionally redirects execution using pre-signed return addresses from DMHooker's PAC cache, bypassing camera permission checks. Return value 3 instructs DMHooker to redirect execution using a pre-signed return address.
## VoIP Recording Gap
The VoIP recording module lacks built-in indicator suppression. It hooks AudioConverterNew and AudioConverterConvertComplexBuffer+52 in mediaserverd for audio capture (detecting sample rates 16-48kHz, converting float32 PCM to int16 via NEON SIMD, downmixing 4-channel to stereo). Operators must manually activate HiddenDot first — an operational gap revealing modular but non-automatic stealth.
VoIP recordings are stored at /private/var/tmp/l/voip_%lu_%u_PART.m4a.
## Anti-Analysis Architecture (January 2026 Jamf Research)
Prior Jamf research (January 14, 2026) documented Predator's CSWatcherSpawner anti-analysis system with error code taxonomy (301-311): - Error 301: Developer Mode enabled (security.mac.amfi.developer_mode_status) - Error 304: Security tools running (frida-server, tcpdump, netstat, sshd, checkra1nd, McAfee, Avast, Norton) - Error 307: HTTP proxy configured - Error 308: Custom root CA installed - Error 309: US or IL locale (geographic restrictions to avoid legal exposure) - Error 310: Console attached (timing-based diagnosticd detection) - Error 311: Multiple Predator instances running
## Intellexa Background
Intellexa is a US-sanctioned (OFAC, March 2024) surveillance consortium developing Predator commercial spyware since 2019. OFAC designated two individuals and five entities. Predator has been deployed against journalists, activists, human rights defenders, and US government officials across multiple countries.
Google Threat Intelligence Group (December 2025) documented Intellexa as responsible for 15 unique zero-day vulnerabilities since 2021 (Chrome V8, iOS WebKit, Android kernel, ARM Mali). The JSKit exploit framework is shared across multiple surveillance vendors. Most recent zero-day: CVE-2025-6554 (Chrome V8 type confusion) observed in Saudi Arabia in June 2025.
Amnesty International's Security Lab (December 2025) confirmed via "Intellexa Leaks" that Predator continues active deployment despite sanctions, with new evidence of use in Pakistan against a Balochistan human rights lawyer in summer 2025. Leaked training videos revealed Intellexa retains capability to remotely access customer Predator systems.
## Forensic Detection Artifacts
- Unexpected memory mappings in SpringBoard and mediaserverd - Exception port registration by non-system code in system processes - Breakpoint-based hooks (EXC_BREAKPOINT handlers pointing to non-system code) - thread_set_state calls modifying register contents - Audio files written by mediaserverd to unusual paths (/private/var/tmp/l/) - Processes running from /private/var/tmp/ (staging directory)
## Impact
This technique requires no new iOS vulnerability — it leverages previously obtained kernel-level access from zero-day exploit chains. With indicators suppressed, victims receive no visual warning that surveillance is occurring. The phone works normally while camera and microphone feeds are streamed to operators. This affects any iOS 14+ device that has been compromised via Predator's zero-click or one-click infection mechanisms.
MITRE ATT&CK techniques used in TL-2026-0132
defense-evasion
T1014 Rootkit; T1027 Obfuscated Files or Information; T1055 Process Injection; T1070 Indicator Removal; T1497.001 System Checks; T1564 Hide Artifacts; T1622 Debugger Evasion
persistence
T1037 Boot or Logon Initialization Scripts
exfiltration
T1041 Exfiltration Over C2 Channel
collection
T1056.001 Keylogging; T1113 Screen Capture; T1123 Audio Capture; T1125 Video Capture
discovery
T1057 Process Discovery; T1082 System Information Discovery; T1083 File and Directory Discovery; T1518.001 Security Software Discovery; T1614 System Location Discovery
privilege-escalation
T1068 Exploitation for Privilege Escalation
command-and-control
execution
T1106 Native API; T1203 Exploitation for Client Execution
initial-access
T1190 Exploit Public-Facing Application; T1566.002 Spearphishing Link
defense-impairment
T1553.006 Code Signing Policy Modification; T1685 Disable or Modify Tools
stealth
resource-development
Affected products and versions in Predator Spyware iOS SpringBoard Hook
- Apple — iOS
Vulnerable versions: iOS 14.0+
Fixed in: No specific fix — post-compromise technique requiring kernel access - Apple — SpringBoard
Vulnerable versions: All versions with SBSensorActivityDataProvider
Fixed in: N/A — requires kernel-level compromise first - Apple — mediaserverd
Vulnerable versions: All versions — CameraEnabler and VoIP hooks target this daemon
Fixed in: N/A — requires kernel-level compromise first
Remediation for Predator Spyware iOS SpringBoard Hook
Patches
- Keep iOS updated to latest version — Predator exploit chains target specific iOS versions
- No specific patch for indicator suppression — technique leverages post-compromise kernel access
Immediate actions
- Deploy mobile threat defense (MTD) solutions capable of detecting Predator artifacts
- Check for unexpected memory mappings in SpringBoard and mediaserverd processes
- Monitor for EXC_BREAKPOINT handlers pointing to non-system code
- Inspect /private/var/tmp/ for unauthorized processes or audio files
- Enable Lockdown Mode on iOS devices for high-risk individuals
Workarounds
- Enable Lockdown Mode (reduces attack surface for zero-click infections)
- Reboot device regularly (Predator does not survive reboot on modern iOS)
- Use iVerify or similar tools for periodic device integrity checks
- Monitor diagnosticd logs for anomalous process behavior
Longer-term hardening
- Implement mobile device management (MDM) with continuous integrity monitoring
- Deploy Jamf Protect or equivalent for iOS forensic detection
- Establish process for regular forensic analysis of high-value target devices
- Implement network monitoring for C2 communication patterns
- Adopt Apple's Lockdown Mode organization-wide for executives, journalists, diplomats
Weaknesses (CWE) in Predator Spyware iOS SpringBoard Hook
CWE-829, CWE-693, CWE-200
Timeline of Predator Spyware iOS SpringBoard Hook
- Apple releases iOS 14 with camera (green) and microphone (orange) recording indicators in status bar — privacy feature Predator later defeats.
- ZecOps (now Jamf) publishes NoReboot technique — simulating device shutdown while maintaining surveillance. Different approach from Predator's selective indicator suppression.
- President Biden signs Executive Order 14093 prohibiting US Government use of commercial spyware posing national security risks — directly targeting Intellexa/Predator operations.
- Google TAG and CitizenLab capture full iOS zero-day exploit chain (CVE-2023-41993/41992/41991) used by Intellexa to target Egyptian presidential candidate Ahmed Eltantawy with Predator. Source: https://citizenlab.ca/2023/09/predator-in-the-wires-ahmed-eltantawy-targeted-with-predator-spyware-after-announcing-presidential-ambitions/
- US Treasury OFAC sanctions Intellexa Consortium — 2 individuals, 5 entities designated for developing and distributing Predator spyware used to target Americans. Source: https://home.treasury.gov/news/press-releases/jy2155
- Most recent Intellexa zero-day CVE-2025-6554 (Chrome V8 type confusion) observed in Saudi Arabia. Chrome patches in version 138.0.7204.96.
- Amnesty International, Google GTIG, and Recorded Future simultaneously publish research confirming Intellexa continues operations despite sanctions. 'Intellexa Leaks' expose internal operations, training videos, and active Predator deployment in Pakistan.
- Jamf Threat Labs publishes analysis of Predator's CSWatcherSpawner anti-analysis system with error code taxonomy (301-311), including developer mode detection, geographic restrictions (US/IL), and security tool detection. Source: https://www.jamf.com/blog/predator-spyware-anti-analysis-techniques-ios-error-codes-detection/
- Jamf Threat Labs (Nir Avraham, Hu Ke) publishes detailed technical analysis of HiddenDot recording indicator bypass — first documentation of SBSensorActivityDataProvider hook, Objective-C nil messaging exploitation, CameraEnabler PAC bypass, and VoIP recording architecture. Source: https://www.jamf.com/blog/predator-spyware-ios-recording-indicator-bypass-analysis/
- BleepingComputer reports on Jamf's HiddenDot findings. Apple did not respond to request for comment. Source: https://www.bleepingcomputer.com/news/security/predator-spyware-hooks-ios-springboard-to-hide-mic-camera-activity/
- As of 2026-05-29, the Predator HiddenDot indicator-bypass stays ACTIVE: it works on iOS 14-18 (only iPhone 16+ ExclaveOS mitigates it), Apple gave no public fix (Jamf/BleepingComputer Feb 2026), and Intellexa keeps deploying it (Angola, Iraq, new Aladdin ad vector). Greek convictions of Dilian et al. were suspended on appeal and the US lifted three sanctions, so the actor remains operational.
Sources cited for Predator Spyware iOS SpringBoard Hook
- Jamf: How Predator spyware defeats iOS recording indicators
- BleepingComputer: Predator spyware hooks iOS SpringBoard to hide mic, camera activity
- Jamf: Predator's kill switch: undocumented anti-analysis techniques in iOS spyware
- Google TAG: Sanctioned but Still Spying — Intellexa's Prolific Zero-Day Exploits Continue
- Amnesty International: To Catch a Predator — Intellexa Leaks
- US Treasury OFAC: Sanctions on Intellexa Commercial Spyware Consortium
- Google TAG: 0-days exploited by commercial surveillance vendor in Egypt (CitizenLab collab)
- CitizenLab: Predator in the Wires — Ahmed Eltantawy targeted
- Google TAG: Buying Spying — Insights into Commercial Surveillance Vendors
- Jamf/ZecOps: NoReboot — Faking an iPhone Restart
- Recorded Future: Intellexa's Global Corporate Web
- Apple Developer: About App Privacy Report
- Executive Order 14093: Prohibition on US Government Use of Commercial Spyware
Threats related to Predator Spyware iOS SpringBoard Hook
Detection coverage for TL-2026-0132
As of 2026-02-22, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0132 across Splunk SPL, Microsoft KQL and Sigma, covering 16 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.