Predator Spyware iOS SpringBoard Hook — Intellexa Recording Indicator Bypass via Kernel-Level Sensor Interception — Threadlinqs Intelligence
As of 2026-05-30, Predator Spyware iOS SpringBoard Hook — Intellexa Recording Indicator Bypass via Kernel-Level Sensor Interception is a high-severity malware threat attributed to Intellexa Consortium (Israel), tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 16 indicators of compromise.
Threat ID: TL-2026-0132 · Severity: HIGH · Status: ACTIVE · Category: MALWARE
Attribution: Intellexa Consortium · Israel · ESPIONAGE
Jamf Threat Labs published first detailed technical analysis of how Intellexa's US-sanctioned Predator spyware suppresses iOS camera and microphone recording indicators (green/orange dots). Using
Jamf Threat Labs researchers Nir Avraham and Hu Ke published technical analysis on February 19, 2026 documenting how Intellexa's Predator spyware defeats iOS recording privacy indicators — the green (camera) and orange (microphone) dots Apple introduced in iOS 14.
## Technical Mechanism
Predator uses a single hook function (HiddenDot::setupHook()) inside SpringBoard, iOS's home screen and UI controller process. The hook targets SBSensorActivityDataProvider._handleNewDomainData:, which is called by iOS whenever sensor activity changes (camera activation, microphone activation). By intercepting this single method, Predator blocks ALL sensor status updates before they reach the indicator display system.
The suppression mechanism exploits a fundamental feature of Objective-C: messages sent to nil are silently ignored. At the ARM64 assembly level, a single STR XZR instruction writes zero to the thread state, setting the self pointer (x0 register) to NULL. When the hooked method executes, the call becomes [nil _handleNewDomainData:newData], which returns nil/0 without executing any code. SpringBoard never learns that the camera or microphone became active.
The hook callback returns value 2, which in DMHooker's exception-based hooking system means "continue execution with the modified thread state."
## Key Finding: Single Hook, Dual Suppression
SBSensorActivityDataProvider aggregates ALL sensor activity before dispatching to the UI layer. By intercepting _handleNewDomainData:, this single hook disables both camera AND microphone indicators simultaneously — more efficient than the abandoned alternative found in dead code (CSWatcherSpawner::TestHooker()) that would have required separate hooks for SBRecordingIndicatorManager.
## Camera Access: PAC Bypass
A separate CameraEnabler module uses ARM64 instruction pattern matching (via memmem()) to locate internal camera functions near FigVideoCaptureSourceCreateWithSourceInfo. The callback conditionally redirects execution using pre-signed return addresses from DMHooker's PAC cache, bypassing camera permission checks. Return value 3 instructs DMHooker to redirect execution using a pre-signed return address.
## VoIP Recording Gap
The VoIP recording module lacks built-in indicator suppression. It hooks AudioConverterNew and AudioConverterConvertComplexBuffer+52 in mediaserverd for audio capture (detecting sample rates 16-48kHz, converting float32 PCM to int16 via NEON SIMD, downmixing 4-channel to stereo). Operators must manually activate HiddenDot first — an operational gap revealing modular but non-automatic stealth.
VoIP recordings are stored at /private/var/tmp/l/voip_%lu_%u_PART.m4a.
## Anti-Analysis Architecture (January 2026 Jamf Research)
Prior Jamf research (January 14, 2026) documented Predator's CSWatcherSpawner anti-analysis system with error code taxonomy (301-311):
- Error 301: Developer Mode enabled (security.mac.amfi.developer_mode_status)
- Error 304: Security tools running (frida-server, tcpdump, netstat, sshd, checkra1nd, McAfee, Avast, Norton)
- Error 307: HTTP proxy configured
- Error 308: Custom root CA installed
- Error 309: US or IL locale (geographic restrictions to avoid legal exposure)
- Error 310: Console attached (timing-based diagnosticd detection)
- Error 311: Multiple Predator instances running
## Intellexa Background
Intellexa is a US-sanctioned (OFAC, March 2024) surveillance consortium developing Predator commercial spyware since 2019. OFAC designated two individuals and five entities. Predator has been deployed against journalists, activists, human rights defenders, and US government officials across multiple countries.
Google Threat Intelligence Group (December 2025) documented Intellexa as responsible for 15 unique zero-day vulnerabilities since 2021 (Chrome V8, iOS WebKit, Android kernel, ARM Mali). The JSKit exploit framework is shared across multiple surveillance vendors. Most recent zero-day: CVE-2025-6554 (Chrome V8 type confusion) ob
Weaknesses (CWE)
CWE-829, CWE-693, CWE-200
Target sectors: government, journalism, human-rights, civil-society, diplomacy, legal, political-opposition
Target regions: Global, Middle East, North Africa, Europe, South Asia, Southeast Asia
Detections & IOCs
As of 2026-07-20, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 16 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
MALWARE, HIGH, threat intelligence, cybersecurity, T1123, T1125, T1113, T1056.001, T1070, T1564, T1553.006, T1055, T1562.001, T1622