Predator Spyware iOS SpringBoard Hook — Intellexa Recording Indicator Bypass via Kernel-Level Sensor Interception

Key facts

Detection coverage

As of 2026-02-22, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0132 across Splunk SPL, Microsoft KQL and Sigma, covering 16 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Predator VoIP Recording via mediaserverd Hooks and Anti-Analysis Error Code Detection

Detects VoIP capture: mediaserverd AudioConverter hooks writing M4A to /private/var/tmp/l/voip_*.m4a, camera activated without TCC permission grant. Anti-analysis: sysctlbyname developer_mode_status check (error 301), process enumeration for frida/tcpdump/sshd/checkra1nd (error 304), NSLocale US/IL check (error 309), diagnosticd timing (error 310).

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1123, T1125, T1622, T1518.001, T1497.001
• Data sources: ios_mtd_logs, file_system_monitoring, process_monitoring
• Severity: critical
• Confidence: high

Splunk SPL

index=ios sourcetype="ios:mtd"
| search (file_path="/private/var/tmp/l/voip_*" AND file_extension="m4a")
| eval alert="predator_voip_recording"
| append [search index=ios sourcetype="ios:mtd" process="mediaserverd" (event_type="exception_port_registration" OR event_type="breakpoint_hook") | where NOT match(source, "^/System/") | eval alert="mediaserverd_audio_hook"]
| append [search index=ios sourcetype="ios:mtd" syscall="sysctlbyname" argument="*developer_mode_status*" | where NOT match(process, "(Settings|Xcode)") | eval alert="anti_analysis_error_301"]
| append [search index=ios sourcetype="ios:mtd" event_type="process_scan" target_process IN ("frida-server", "tcpdump", "sshd", "checkra1nd") | eval alert="anti_analysis_error_304"]
| table _time, device_id, process, file_path, alert

Microsoft KQL

let voip = DeviceFileEvents
| where Timestamp > ago(24h)
| where FolderPath startswith "/private/var/tmp/l/"
| where FileName startswith "voip_" and FileName endswith ".m4a"
| extend AlertType = "predator_voip_recording";
let anti_analysis = SecurityAlert
| where Timestamp > ago(24h)
| where ProductName has_any ("Jamf", "Lookout", "Zimperium")
| where AlertName has_any ("developer_mode", "frida", "security_tool", "debugger", "proxy_detection", "locale_check")
| extend AlertType = "predator_anti_analysis";
let camera = DeviceEvents
| where Timestamp > ago(24h)
| where ActionType == "CameraAccess"
| where not(InitiatingProcessFileName in ("Camera", "FaceTime", "PhotoBooth"))
| extend AlertType = "silent_camera_activation";
union voip, anti_analysis, camera
| project Timestamp, DeviceName, FileName, FolderPath, AlertType, AlertName
| sort by Timestamp desc

Sigma

title: Audio File Written to Predator VoIP Recording Path (/private/var/tmp/l/voip_*.m4a)
id: 03743010-7385-4a3b-a946-c265fc63a5fe
status: experimental
description: Detects M4A audio files written to /private/var/tmp/l/voip_* — Predator VoIP recording output path. Also covers mediaserverd AudioConverter hooks and anti-analysis error code triggers.
references:
    - https://www.jamf.com/blog/predator-mobile-spyware-hiddendot/
author: Threadlinqs Team
date: 2026/02/22
tags:
    - attack.collection
    - attack.t1123
    - attack.t1125
    - attack.defense_evasion
    - attack.t1622
logsource:
    product: ios
    category: file_create
detection:
    selection:
        TargetFilename|startswith: '/private/var/tmp/l/voip_'
        TargetFilename|endswith: '.m4a'
    condition: selection
falsepositives:
    - No legitimate iOS process writes to /private/var/tmp/l/voip_* path
level: critical

Known false positives:

• No legitimate iOS process writes to /private/var/tmp/l/voip_* path

Tuning notes: Monitor /private/var/tmp/l/ directory for any file creation. VoIP path is unique to Predator — zero false positives expected. For anti-analysis, monitor sysctlbyname calls for developer_mode_status from non-system processes.

• 🔒 iOS Device Integrity Violation and Mobile Threat Defense Alert Correlation for Predator · unlock with TL Creds
• 🔒 Predator Collection Capabilities and CSWatcherSpawner Anti-Analysis Behavioral Detection · unlock with TL Creds
• 🔒 Predator C2 Exfiltration, Staging Directory Activity, and Intellexa Infrastructure Contact · unlock with TL Creds
• 🔒 Unexpected Non-System Memory Mapping in SpringBoard Process (Predator Code Injection) · unlock with TL Creds
• 🔒 Predator Security Tool Enumeration and Geographic Locale Restriction Detection · unlock with TL Creds
• 🔒 Predator Staging Directory Process Execution and Captured Data Exfiltration · unlock with TL Creds
• 🔒 Predator HiddenDot SpringBoard Hook and CameraEnabler PAC Bypass Detection · unlock with TL Creds
• 🔒 Predator Self-Cleanup Artifact Deletion, C2 Data Exfiltration, and PREYHUNTER Socket · unlock with TL Creds

Indicators of compromise

As of 2026-02-22, Threadlinqs Intelligence tracks 16 indicators of compromise for TL-2026-0132.

Technical analysis

A single hook defeats both camera and microphone indicators simultaneously.

Jamf Threat Labs researchers Nir Avraham and Hu Ke published technical analysis on February 19, 2026 documenting how Intellexa's Predator spyware defeats iOS recording privacy indicators — the green (camera) and orange (microphone) dots Apple introduced in iOS 14.

## Technical Mechanism

Predator uses a single hook function (HiddenDot::setupHook()) inside SpringBoard, iOS's home screen and UI controller process. The hook targets SBSensorActivityDataProvider._handleNewDomainData:, which is called by iOS whenever sensor activity changes (camera activation, microphone activation). By intercepting this single method, Predator blocks ALL sensor status updates before they reach the indicator display system.

The suppression mechanism exploits a fundamental feature of Objective-C: messages sent to nil are silently ignored. At the ARM64 assembly level, a single STR XZR instruction writes zero to the thread state, setting the self pointer (x0 register) to NULL. When the hooked method executes, the call becomes [nil _handleNewDomainData:newData], which returns nil/0 without executing any code. SpringBoard never learns that the camera or microphone became active.

The hook callback returns value 2, which in DMHooker's exception-based hooking system means "continue execution with the modified thread state."

## Key Finding: Single Hook, Dual Suppression

SBSensorActivityDataProvider aggregates ALL sensor activity before dispatching to the UI layer. By intercepting _handleNewDomainData:, this single hook disables both camera AND microphone indicators simultaneously — more efficient than the abandoned alternative found in dead code (CSWatcherSpawner::TestHooker()) that would have required separate hooks for SBRecordingIndicatorManager.

## Camera Access: PAC Bypass

A separate CameraEnabler module uses ARM64 instruction pattern matching (via memmem()) to locate internal camera functions near FigVideoCaptureSourceCreateWithSourceInfo. The callback conditionally redirects execution using pre-signed return addresses from DMHooker's PAC cache, bypassing camera permission checks. Return value 3 instructs DMHooker to redirect execution using a pre-signed return address.

## VoIP Recording Gap

The VoIP recording module lacks built-in indicator suppression. It hooks AudioConverterNew and AudioConverterConvertComplexBuffer+52 in mediaserverd for audio capture (detecting sample rates 16-48kHz, converting float32 PCM to int16 via NEON SIMD, downmixing 4-channel to stereo). Operators must manually activate HiddenDot first — an operational gap revealing modular but non-automatic stealth.

VoIP recordings are stored at /private/var/tmp/l/voip_%lu_%u_PART.m4a.

## Anti-Analysis Architecture (January 2026 Jamf Research)

Prior Jamf research (January 14, 2026) documented Predator's CSWatcherSpawner anti-analysis system with error code taxonomy (301-311): - Error 301: Developer Mode enabled (security.mac.amfi.developer_mode_status) - Error 304: Security tools running (frida-server, tcpdump, netstat, sshd, checkra1nd, McAfee, Avast, Norton) - Error 307: HTTP proxy configured - Error 308: Custom root CA installed - Error 309: US or IL locale (geographic restrictions to avoid legal exposure) - Error 310: Console attached (timing-based diagnosticd detection) - Error 311: Multiple Predator instances running

## Intellexa Background

Intellexa is a US-sanctioned (OFAC, March 2024) surveillance consortium developing Predator commercial spyware since 2019. OFAC designated two individuals and five entities. Predator has been deployed against journalists, activists, human rights defenders, and US government officials across multiple countries.

Google Threat Intelligence Group (December 2025) documented Intellexa as responsible for 15 unique zero-day vulnerabilities since 2021 (Chrome V8, iOS WebKit, Android kernel, ARM Mali). The JSKit exploit framework is shared across multiple surveillance vendors. Most recent zero-day: CVE-2025-6554 (Chrome V8 type confusion) observed in Saudi Arabia in June 2025.

Amnesty International's Security Lab (December 2025) confirmed via "Intellexa Leaks" that Predator continues active deployment despite sanctions, with new evidence of use in Pakistan against a Balochistan human rights lawyer in summer 2025. Leaked training videos revealed Intellexa retains capability to remotely access customer Predator systems.

## Forensic Detection Artifacts

- Unexpected memory mappings in SpringBoard and mediaserverd - Exception port registration by non-system code in system processes - Breakpoint-based hooks (EXC_BREAKPOINT handlers pointing to non-system code) - thread_set_state calls modifying register contents - Audio files written by mediaserverd to unusual paths (/private/var/tmp/l/) - Processes running from /private/var/tmp/ (staging directory)

## Impact

This technique requires no new iOS vulnerability — it leverages previously obtained kernel-level access from zero-day exploit chains. With indicators suppressed, victims receive no visual warning that surveillance is occurring. The phone works normally while camera and microphone feeds are streamed to operators. This affects any iOS 14+ device that has been compromised via Predator's zero-click or one-click infection mechanisms.

MITRE ATT&CK techniques by tactic:

defense-evasion

T1014 Rootkit; T1027 Obfuscated Files or Information; T1055 Process Injection; T1070 Indicator Removal; T1497.001 System Checks; T1564 Hide Artifacts; T1622 Debugger Evasion

persistence

T1037 Boot or Logon Initialization Scripts

exfiltration

T1041 Exfiltration Over C2 Channel

collection

T1056.001 Keylogging; T1113 Screen Capture; T1123 Audio Capture; T1125 Video Capture

discovery

T1057 Process Discovery; T1082 System Information Discovery; T1083 File and Directory Discovery; T1518.001 Security Software Discovery; T1614 System Location Discovery

privilege-escalation

T1068 Exploitation for Privilege Escalation

command-and-control

T1071.001 Web Protocols

execution

T1106 Native API; T1203 Exploitation for Client Execution

initial-access

T1190 Exploit Public-Facing Application; T1566.002 Spearphishing Link

defense-impairment

T1553.006 Code Signing Policy Modification; T1685 Disable or Modify Tools

stealth

T1574.013 KernelCallbackTable

resource-development

T1587.001 Malware; T1587.004 Exploits; T1588.005 Exploits

Remediation

Patches

• Keep iOS updated to latest version — Predator exploit chains target specific iOS versions
• No specific patch for indicator suppression — technique leverages post-compromise kernel access

Immediate actions

• Deploy mobile threat defense (MTD) solutions capable of detecting Predator artifacts
• Check for unexpected memory mappings in SpringBoard and mediaserverd processes
• Monitor for EXC_BREAKPOINT handlers pointing to non-system code
• Inspect /private/var/tmp/ for unauthorized processes or audio files
• Enable Lockdown Mode on iOS devices for high-risk individuals

Workarounds

• Enable Lockdown Mode (reduces attack surface for zero-click infections)
• Reboot device regularly (Predator does not survive reboot on modern iOS)
• Use iVerify or similar tools for periodic device integrity checks
• Monitor diagnosticd logs for anomalous process behavior

Longer-term hardening

• Implement mobile device management (MDM) with continuous integrity monitoring
• Deploy Jamf Protect or equivalent for iOS forensic detection
• Establish process for regular forensic analysis of high-value target devices
• Implement network monitoring for C2 communication patterns
• Adopt Apple's Lockdown Mode organization-wide for executives, journalists, diplomats

Affected and fixed versions

• Apple — iOS
  Vulnerable versions: iOS 14.0+
  Fixed in: No specific fix — post-compromise technique requiring kernel access
• Apple — SpringBoard
  Vulnerable versions: All versions with SBSensorActivityDataProvider
  Fixed in: N/A — requires kernel-level compromise first
• Apple — mediaserverd
  Vulnerable versions: All versions — CameraEnabler and VoIP hooks target this daemon
  Fixed in: N/A — requires kernel-level compromise first

Timeline

• 2020-09-16 Apple releases iOS 14 with camera (green) and microphone (orange) recording indicators in status bar — privacy feature Predator later defeats.
• 2022-01-05 ZecOps (now Jamf) publishes NoReboot technique — simulating device shutdown while maintaining surveillance. Different approach from Predator's selective indicator suppression.
• 2023-03-27 President Biden signs Executive Order 14093 prohibiting US Government use of commercial spyware posing national security risks — directly targeting Intellexa/Predator operations.
• 2023-09-22 Google TAG and CitizenLab capture full iOS zero-day exploit chain (CVE-2023-41993/41992/41991) used by Intellexa to target Egyptian presidential candidate Ahmed Eltantawy with Predator. Source: https://citizenlab.ca/2023/09/predator-in-the-wires-ahmed-eltantawy-targeted-with-predator-spyware-after-announcing-presidential-ambitions/
• 2024-03-05 US Treasury OFAC sanctions Intellexa Consortium — 2 individuals, 5 entities designated for developing and distributing Predator spyware used to target Americans. Source: https://home.treasury.gov/news/press-releases/jy2155
• 2025-06-30 Most recent Intellexa zero-day CVE-2025-6554 (Chrome V8 type confusion) observed in Saudi Arabia. Chrome patches in version 138.0.7204.96.
• 2025-12-03 Amnesty International, Google GTIG, and Recorded Future simultaneously publish research confirming Intellexa continues operations despite sanctions. 'Intellexa Leaks' expose internal operations, training videos, and active Predator deployment in Pakistan.
• 2026-01-14 Jamf Threat Labs publishes analysis of Predator's CSWatcherSpawner anti-analysis system with error code taxonomy (301-311), including developer mode detection, geographic restrictions (US/IL), and security tool detection. Source: https://www.jamf.com/blog/predator-spyware-anti-analysis-techniques-ios-error-codes-detection/
• 2026-02-19 Jamf Threat Labs (Nir Avraham, Hu Ke) publishes detailed technical analysis of HiddenDot recording indicator bypass — first documentation of SBSensorActivityDataProvider hook, Objective-C nil messaging exploitation, CameraEnabler PAC bypass, and VoIP recording architecture. Source: https://www.jamf.com/blog/predator-spyware-ios-recording-indicator-bypass-analysis/
• 2026-02-21 BleepingComputer reports on Jamf's HiddenDot findings. Apple did not respond to request for comment. Source: https://www.bleepingcomputer.com/news/security/predator-spyware-hooks-ios-springboard-to-hide-mic-camera-activity/
• 2026-05-29 As of 2026-05-29, the Predator HiddenDot indicator-bypass stays ACTIVE: it works on iOS 14-18 (only iPhone 16+ ExclaveOS mitigates it), Apple gave no public fix (Jamf/BleepingComputer Feb 2026), and Intellexa keeps deploying it (Angola, Iraq, new Aladdin ad vector). Greek convictions of Dilian et al. were suspended on appeal and the US lifted three sanctions, so the actor remains operational.

Sources cited

• US Treasury OFAC: Sanctions on Intellexa Commercial Spyware Consortium home.treasury.gov · Advisory · 2024-03-05
• Executive Order 14093: Prohibition on US Government Use of Commercial Spyware whitehouse.gov · Advisory · 2023-03-27
• Jamf: How Predator spyware defeats iOS recording indicators jamf.com · Research · 2026-02-19
• Jamf: Predator's kill switch: undocumented anti-analysis techniques in iOS spyware jamf.com · Research · 2026-01-14
• Google TAG: Sanctioned but Still Spying — Intellexa's Prolific Zero-Day Exploits Continue Google Cloud · Research · 2025-12-03
• Amnesty International: To Catch a Predator — Intellexa Leaks securitylab.amnesty.org · Research · 2025-12-03
• Google TAG: 0-days exploited by commercial surveillance vendor in Egypt (CitizenLab collab) Google · Research · 2023-09-22
• CitizenLab: Predator in the Wires — Ahmed Eltantawy targeted citizenlab.ca · Research · 2023-09-22
• Google TAG: Buying Spying — Insights into Commercial Surveillance Vendors Google · Research · 2024-02-06
• Jamf/ZecOps: NoReboot — Faking an iPhone Restart jamf.com · Research · 2022-01-05
• Recorded Future: Intellexa's Global Corporate Web Recorded Future · Research · 2025-12-03
• Apple Developer: About App Privacy Report Apple · Vendor report · 2025-12-01
• BleepingComputer: Predator spyware hooks iOS SpringBoard to hide mic, camera activity BleepingComputer · News · 2026-02-21

Related threats

• Predator Spyware: Undocumented iOS Kernel Exploitation Engine (FDGuardNeonRW, PAC Bypass, RWTransfer)

More from Intellexa Consortium

• Predator, Pegasus and Graphite Mercenary Spyware: Government-Linked Abuse Against Journalists, Activists and Politicians in Europe with Little Accountability
• Apple Expands On-Device Lock Screen Alerts for Mercenary Spyware Targets

Previous and next in malware

• ClickFix Browser Cache Smuggling — Social Engineering MaaS Toolkit Storing Malware Payloads in Browser Cache to Bypass EDR, Firewalls, and Download Alerts Previous report
• PromptSpy — First Android Malware Using Generative AI (Gemini) for Context-Aware UI Manipulation, VNC Remote Access, Chase Bank Impersonation Next report