# Predator Spyware iOS SpringBoard Hook — Intellexa Recording Indicator Bypass via Kernel-Level Sensor Interception

> Jamf Threat Labs published first detailed technical analysis of how Intellexa's US-sanctioned Predator spyware suppresses iOS camera and microphone recording indicators (green/orange dots). Using kernel-level access, Predator hooks SpringBoard's SBSensorActivityDataProvider._handleNewDomainData: method, nullifying the sensor data object via Objective-C nil messaging to silently drop all indicator updates. A single hook defeats both camera and microphone indicators simultaneously.

- **Published:** 2026-02-22T12:00:00Z
- **Last reviewed:** 2026-02-22T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0132
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-predator-ios-indicator-bypass-tl-2026-0132.webp?v=2fe434aa (Threadlinqs threat intel: Predator Spyware Hides iOS Camera Dots: Detection & IOCs (TL-2026-0132) — High severity, 16 IOCs, 9 detection rules.)
- **ID:** TL-2026-0132
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** Intellexa Consortium (Israel)
- **Detections:** 9 (1 shown free below) · **IOCs:** 16

## Description

Jamf Threat Labs researchers Nir Avraham and Hu Ke published technical analysis on February 19, 2026 documenting how Intellexa's Predator spyware defeats iOS recording privacy indicators — the green (camera) and orange (microphone) dots Apple introduced in iOS 14.

## Technical Mechanism

Predator uses a single hook function (HiddenDot::setupHook()) inside SpringBoard, iOS's home screen and UI controller process. The hook targets SBSensorActivityDataProvider._handleNewDomainData:, which is called by iOS whenever sensor activity changes (camera activation, microphone activation). By intercepting this single method, Predator blocks ALL sensor status updates before they reach the indicator display system.

The suppression mechanism exploits a fundamental feature of Objective-C: messages sent to nil are silently ignored. At the ARM64 assembly level, a single STR XZR instruction writes zero to the thread state, setting the self pointer (x0 register) to NULL. When the hooked method executes, the call becomes [nil _handleNewDomainData:newData], which returns nil/0 without executing any code. SpringBoard never learns that the camera or microphone became active.

The hook callback returns value 2, which in DMHooker's exception-based hooking system means "continue execution with the modified thread state."

## Key Finding: Single Hook, Dual Suppression

SBSensorActivityDataProvider aggregates ALL sensor activity before dispatching to the UI layer. By intercepting _handleNewDomainData:, this single hook disables both camera AND microphone indicators simultaneously — more efficient than the abandoned alternative found in dead code (CSWatcherSpawner::TestHooker()) that would have required separate hooks for SBRecordingIndicatorManager.

## Camera Access: PAC Bypass

A separate CameraEnabler module uses ARM64 instruction pattern matching (via memmem()) to locate internal camera functions near FigVideoCaptureSourceCreateWithSourceInfo. The callback conditionally redirects execution using pre-signed return addresses from DMHooker's PAC cache, bypassing camera permission checks. Return value 3 instructs DMHooker to redirect execution using a pre-signed return address.

## VoIP Recording Gap

The VoIP recording module lacks built-in indicator suppression. It hooks AudioConverterNew and AudioConverterConvertComplexBuffer+52 in mediaserverd for audio capture (detecting sample rates 16-48kHz, converting float32 PCM to int16 via NEON SIMD, downmixing 4-channel to stereo). Operators must manually activate HiddenDot first — an operational gap revealing modular but non-automatic stealth.

VoIP recordings are stored at /private/var/tmp/l/voip_%lu_%u_PART.m4a.

## Anti-Analysis Architecture (January 2026 Jamf Research)

Prior Jamf research (January 14, 2026) documented Predator's CSWatcherSpawner anti-analysis system with error code taxonomy (301-311):
- Error 301: Developer Mode enabled (security.mac.amfi.developer_mode_status)
- Error 304: Security tools running (frida-server, tcpdump, netstat, sshd, checkra1nd, McAfee, Avast, Norton)
- Error 307: HTTP proxy configured
- Error 308: Custom root CA installed
- Error 309: US or IL locale (geographic restrictions to avoid legal exposure)
- Error 310: Console attached (timing-based diagnosticd detection)
- Error 311: Multiple Predator instances running

## Intellexa Background

Intellexa is a US-sanctioned (OFAC, March 2024) surveillance consortium developing Predator commercial spyware since 2019. OFAC designated two individuals and five entities. Predator has been deployed against journalists, activists, human rights defenders, and US government officials across multiple countries.

Google Threat Intelligence Group (December 2025) documented Intellexa as responsible for 15 unique zero-day vulnerabilities since 2021 (Chrome V8, iOS WebKit, Android kernel, ARM Mali). The JSKit exploit framework is shared across multiple surveillance vendors. Most recent zero-day: CVE-2025-6554 (Chrome V8 type confusion) observed in Saudi Arabia in June 2025.

Amnesty International's Security Lab (December 2025) confirmed via "Intellexa Leaks" that Predator continues active deployment despite sanctions, with new evidence of use in Pakistan against a Balochistan human rights lawyer in summer 2025. Leaked training videos revealed Intellexa retains capability to remotely access customer Predator systems.

## Forensic Detection Artifacts

- Unexpected memory mappings in SpringBoard and mediaserverd
- Exception port registration by non-system code in system processes
- Breakpoint-based hooks (EXC_BREAKPOINT handlers pointing to non-system code)
- thread_set_state calls modifying register contents
- Audio files written by mediaserverd to unusual paths (/private/var/tmp/l/)
- Processes running from /private/var/tmp/ (staging directory)

## Impact

This technique requires no new iOS vulnerability — it leverages previously obtained kernel-level access from zero-day exploit chains. With indicators suppressed, victims receive no visual warning that surveillance is occurring. The phone works normally while camera and microphone feeds are streamed to operators. This affects any iOS 14+ device that has been compromised via Predator's zero-click or one-click infection mechanisms.

## MITRE ATT&CK

- T1123 Audio Capture
- T1125 Video Capture
- T1113 Screen Capture
- T1056.001 Keylogging
- T1070 Indicator Removal
- T1564 Hide Artifacts
- T1553.006 Code Signing Policy Modification
- T1055 Process Injection
- T1685 Disable or Modify Tools
- T1622 Debugger Evasion
- T1497.001 System Checks
- T1014 Rootkit
- T1027 Obfuscated Files or Information
- T1106 Native API
- T1203 Exploitation for Client Execution
- T1574.013 KernelCallbackTable
- T1037 Boot or Logon Initialization Scripts
- T1068 Exploitation for Privilege Escalation
- T1518.001 Security Software Discovery
- T1082 System Information Discovery
- T1614 System Location Discovery
- T1057 Process Discovery
- T1083 File and Directory Discovery
- T1190 Exploit Public-Facing Application
- T1566.002 Spearphishing Link
- T1588.005 Exploits
- T1587.001 Malware
- T1587.004 Exploits
- T1041 Exfiltration Over C2 Channel
- T1071.001 Web Protocols

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Predator VoIP Recording via mediaserverd Hooks and Anti-Analysis Error Code Detection** (`TL-2026-0132-SPL-002`)

Detects VoIP capture: mediaserverd AudioConverter hooks writing M4A to /private/var/tmp/l/voip_*.m4a, camera activated without TCC permission grant. Anti-analysis: sysctlbyname developer_mode_status check (error 301), process enumeration for frida/tcpdump/sshd/checkra1nd (error 304), NSLocale US/IL check (error 309), diagnosticd timing (error 310).

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1123, T1125, T1622, T1518.001, T1497.001
- **Data sources:** ios_mtd_logs, file_system_monitoring, process_monitoring
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

```spl
index=ios sourcetype="ios:mtd"
| search (file_path="/private/var/tmp/l/voip_*" AND file_extension="m4a")
| eval alert="predator_voip_recording"
| append [search index=ios sourcetype="ios:mtd" process="mediaserverd" (event_type="exception_port_registration" OR event_type="breakpoint_hook") | where NOT match(source, "^/System/") | eval alert="mediaserverd_audio_hook"]
| append [search index=ios sourcetype="ios:mtd" syscall="sysctlbyname" argument="*developer_mode_status*" | where NOT match(process, "(Settings|Xcode)") | eval alert="anti_analysis_error_301"]
| append [search index=ios sourcetype="ios:mtd" event_type="process_scan" target_process IN ("frida-server", "tcpdump", "sshd", "checkra1nd") | eval alert="anti_analysis_error_304"]
| table _time, device_id, process, file_path, alert
```

### Microsoft KQL

```kql
let voip = DeviceFileEvents
| where Timestamp > ago(24h)
| where FolderPath startswith "/private/var/tmp/l/"
| where FileName startswith "voip_" and FileName endswith ".m4a"
| extend AlertType = "predator_voip_recording";
let anti_analysis = SecurityAlert
| where Timestamp > ago(24h)
| where ProductName has_any ("Jamf", "Lookout", "Zimperium")
| where AlertName has_any ("developer_mode", "frida", "security_tool", "debugger", "proxy_detection", "locale_check")
| extend AlertType = "predator_anti_analysis";
let camera = DeviceEvents
| where Timestamp > ago(24h)
| where ActionType == "CameraAccess"
| where not(InitiatingProcessFileName in ("Camera", "FaceTime", "PhotoBooth"))
| extend AlertType = "silent_camera_activation";
union voip, anti_analysis, camera
| project Timestamp, DeviceName, FileName, FolderPath, AlertType, AlertName
| sort by Timestamp desc
```

### Sigma

```yaml
title: Audio File Written to Predator VoIP Recording Path (/private/var/tmp/l/voip_*.m4a)
id: 03743010-7385-4a3b-a946-c265fc63a5fe
status: experimental
description: Detects M4A audio files written to /private/var/tmp/l/voip_* — Predator VoIP recording output path. Also covers mediaserverd AudioConverter hooks and anti-analysis error code triggers.
references:
    - https://www.jamf.com/blog/predator-mobile-spyware-hiddendot/
author: Threadlinqs Team
date: 2026/02/22
tags:
    - attack.collection
    - attack.t1123
    - attack.t1125
    - attack.defense_evasion
    - attack.t1622
logsource:
    product: ios
    category: file_create
detection:
    selection:
        TargetFilename|startswith: '/private/var/tmp/l/voip_'
        TargetFilename|endswith: '.m4a'
    condition: selection
falsepositives:
    - No legitimate iOS process writes to /private/var/tmp/l/voip_* path
level: critical
```

**Known false positives:**

- No legitimate iOS process writes to /private/var/tmp/l/voip_* path

**Tuning notes:** Monitor /private/var/tmp/l/ directory for any file creation. VoIP path is unique to Predator — zero false positives expected. For anti-analysis, monitor sysctlbyname calls for developer_mode_status from non-system processes.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- iOS Device Integrity Violation and Mobile Threat Defense Alert Correlation for Predator (locked: unlock with TL Creds)
- Predator Collection Capabilities and CSWatcherSpawner Anti-Analysis Behavioral Detection (locked: unlock with TL Creds)
- Predator C2 Exfiltration, Staging Directory Activity, and Intellexa Infrastructure Contact (locked: unlock with TL Creds)
- Unexpected Non-System Memory Mapping in SpringBoard Process (Predator Code Injection) (locked: unlock with TL Creds)
- Predator Security Tool Enumeration and Geographic Locale Restriction Detection (locked: unlock with TL Creds)
- Predator Staging Directory Process Execution and Captured Data Exfiltration (locked: unlock with TL Creds)
- Predator HiddenDot SpringBoard Hook and CameraEnabler PAC Bypass Detection (locked: unlock with TL Creds)
- Predator Self-Cleanup Artifact Deletion, C2 Data Exfiltration, and PREYHUNTER Socket (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [Jamf: How Predator spyware defeats iOS recording indicators](https://www.jamf.com/blog/predator-spyware-ios-recording-indicator-bypass-analysis/)
- [BleepingComputer: Predator spyware hooks iOS SpringBoard to hide mic, camera activity](https://www.bleepingcomputer.com/news/security/predator-spyware-hooks-ios-springboard-to-hide-mic-camera-activity/)
- [Jamf: Predator's kill switch: undocumented anti-analysis techniques in iOS spyware](https://www.jamf.com/blog/predator-spyware-anti-analysis-techniques-ios-error-codes-detection/)
- [Google TAG: Sanctioned but Still Spying — Intellexa's Prolific Zero-Day Exploits Continue](https://cloud.google.com/blog/topics/threat-intelligence/intellexa-zero-day-exploits-continue)
- [Amnesty International: To Catch a Predator — Intellexa Leaks](https://securitylab.amnesty.org/latest/2025/12/intellexa-leaks-predator-spyware-operations-exposed/)
- [US Treasury OFAC: Sanctions on Intellexa Commercial Spyware Consortium](https://home.treasury.gov/news/press-releases/jy2155)
- [Google TAG: 0-days exploited by commercial surveillance vendor in Egypt (CitizenLab collab)](https://blog.google/threat-analysis-group/0-days-exploited-by-commercial-surveillance-vendor-in-egypt/)
- [CitizenLab: Predator in the Wires — Ahmed Eltantawy targeted](https://citizenlab.ca/2023/09/predator-in-the-wires-ahmed-eltantawy-targeted-with-predator-spyware-after-announcing-presidential-ambitions/)
- [Google TAG: Buying Spying — Insights into Commercial Surveillance Vendors](https://blog.google/threat-analysis-group/commercial-surveillance-vendors-google-tag-report/)
- [Jamf/ZecOps: NoReboot — Faking an iPhone Restart](https://www.jamf.com/blog/persistence-without-persistence-meet-the-ultimate-persistence-bug-noreboot/)
- [Recorded Future: Intellexa's Global Corporate Web](https://recordedfuture.com/research/intellexas-global-corporate-web)
- [Apple Developer: About App Privacy Report](https://support.apple.com/en-us/102188)
- [Executive Order 14093: Prohibition on US Government Use of Commercial Spyware](https://www.whitehouse.gov/briefing-room/presidential-actions/2023/03/27/executive-order-on-prohibition-on-use-by-the-united-states-government-of-commercial-spyware-that-poses-risks-to-national-security/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0132