Predator Spyware: Undocumented iOS Kernel Exploitation Engine (FDGuardNeonRW, PAC Bypass, RWTransfer) — Threadlinqs Intelligence
As of 2026-04-10, Predator Spyware: Undocumented iOS Kernel Exploitation Engine (FDGuardNeonRW, PAC Bypass, RWTransfer) is a high-severity malware threat attributed to Intellexa Consortium, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 10 indicators of compromise.
Threat ID: TL-2026-2046 · Severity: HIGH · Status: ACTIVE · Category: MALWARE
Attribution: Intellexa Consortium · ESPIONAGE
Jamf Threat Labs reverse-engineered previously undocumented post-exploitation components of Intellexa's Predator commercial iOS spyware: a NEON-register kernel read/write covert channel
Jamf Threat Labs published a three-part technical dossier (January, February, and April 2026) reverse-engineering the post-exploitation "kernel engine" used by Intellexa's Predator commercial spyware on iOS devices predating iOS 17 (iPhone XS through iPhone 14 Pro Max, spanning five internally-numbered device classes 0-4, class 2 unused in the analyzed sample).
The April 2026 report (primary source for this record) details four core engineering components. FDGuardNeonRW is a kernel read/write primitive that abuses ARM NEON vector registers (V0-V31) as a covert, bidirectional data channel: reads load kernel data into NEON registers and trigger a trap that surfaces the data inside a Mach exception message (msgh_id 2406 / 0x966); writes suspend a thread, modify its NEON state at a device-class-specific offset, and replay it via an exception reply, polling up to 3 seconds (10 retries) to confirm the write landed. NEON registers were chosen for their size (512+ bits, enabling 528 bytes per read), their status as ordinary Mach-managed thread state, and their inclusion in exception messages by default. The engine pairs this with a PAC (Pointer Authentication Code) bypass targeting a 20-byte ARM64 gadget (built around a `PACIA X16, X17` instruction) located via `memmem()` near Safari/JavaScriptCore's `JSC::JSArrayBuffer::isShared()` symbol (resolved through `dlopen`/`dlsym`). Rather than re-signing pointers on every call, the malware pre-computes a 256-entry cache of signed pointers (512 total remotePACIA invocations, 256 addresses x 2 PC/LR discriminators), giving near-instant forged signatures for subsequent hooks. callFunc then builds a reusable remote-procedure-call framework: a "trojan thread" parked at a breakpoint in the target process continuously raises Mach exceptions; each exception is intercepted, argument registers x0-x5 are populated, the PAC cache supplies correctly signed PC/LR values, and a "poison LR" return address forces a second breakpoint so the trojan thread can be re-entered indefinitely. On devices without Developer Mode enabled, an internal class (`NSTaskROP::WithoutDeveloperMode`, source-referenced as `TaskROPDevOff.h`) falls back to ROP to reach the same effect. Four sequential callFunc invocations are used to walk the full Objective-C runtime method-resolution chain remotely, correctly handling per-process ASLR. Finally, RWTransfer shares the acquired kernel read/write capability between a "watcher" and a "helper" process: the watcher walks kernel-linked lists at device-class-specific offsets to locate the helper's task structure, then manipulates its IPC space and individual Mach port entries so both processes can operate with kernel-level access. Jamf notes that Apple's A15-and-later Secure Page Table Monitor (SPTM), which moves page-table management to EL2, is a significant architectural mitigation against the kernel-code-modification techniques described.
The January 2026 companion report documents the same engine's anti-analysis "kill switch": a `CSWatcherSpawner` class implements a granular error-code taxonomy (301-311, with 302/303/305/306 unused/reserved) that lets Intellexa operators diagnose exactly why a deployment failed -- root CA installation (301), security-tooling presence such as Frida/tcpdump (304), jailbreak (307), Developer Mode via `sysctlbyname("security.mac.amfi.developer_mode_status")` (308), US/IL locale (309), diagnosticd/console attachment via boot-time-vs-filter-mtime comparison (310), or multiple concurrent instances (311). On trigger, the implant reports the specific error code to its C2 infrastructure, then self-cleans by deleting its staging directory under `/private/var/tmp/` and registers for the `com.apple.springboard.deviceWillShutDown` Darwin notification to run cleanup on shutdown. For anti-forensics, it uses kqueue to watch the CrashReporter log directory and, on detecting a "SystemMemory" crash report (which could expose the implant to memory-dump analysis), SIGKIL
Target sectors: government administration, civil society
Target regions: pakistan, kazakhstan, angola, egypt, uzbekistan, saudi arabia, tajikistan, mongolia
Timeline
- Apple releases the iPhone XS, the oldest device (internally-numbered device class 0) within the affected range documented in Jamf's kernel-engine analysis.
- Apple releases the iPhone 14 Pro Max, the newest device (device class 4) within the affected range documented in Jamf's kernel-engine analysis.
- Citizen Lab, with Google's Threat Analysis Group, publishes 'Predator in the Wires,' documenting the unrelated prior 'smack' iOS zero-day exploit chain (CVE-2023-41993 WebKit RCE, CVE-2023-41991 code-signing bypass, CVE-2023-41992 kernel IPC use-after-free) used to deploy Predator against Egyptian presidential candidate Ahmed Eltantawy -- background tradecraft from the same threat actor, distinct from the FDGuardNeonRW/PAC-bypass engine documented in this record.
- US Treasury/OFAC sanctions members of the Intellexa Consortium, including Cytrox, for developing and distributing Predator spyware used against journalists, activists, and government officials.
- Per Google Threat Intelligence Group, Intellexa exploits CVE-2025-6554 (a Chrome V8 type-confusion vulnerability) against targets in Saudi Arabia -- the most recent of 15 zero-days GTIG attributes to Intellexa since 2021, showing continued operation despite the March 2024 sanctions.
- Google Threat Intelligence Group publishes 'Sanctioned but Still Spying,' documenting Intellexa's continued zero-day exploitation and Predator deployments despite March 2024 US Treasury sanctions.
- Jamf Threat Labs publishes the first report in its Predator kernel-engine series, detailing the CSWatcherSpawner anti-analysis error-code kill-switch and anti-forensics behavior.
- Jamf Threat Labs publishes the second report, detailing the HiddenDot SpringBoard hook that suppresses iOS's camera and microphone recording indicators.
- Jamf Threat Labs publishes the primary report detailing FDGuardNeonRW (NEON-register kernel R/W covert channel), the JavaScriptCore PAC-bypass cache, callFunc remote execution, and RWTransfer cross-process kernel capability sharing.
- TL-Intel Harness ingests the Jamf Threat Labs report via RSS feed monitoring and opens threat TL-2026-2046.
Detections & IOCs
As of 2026-09-06, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 10 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
MALWARE, HIGH, threat intelligence, cybersecurity, T1404, T1631, T1617, T1630, T1630.002, T1633.001, T1418.001, T1424, T1420, T1426
