Jamf Threat Labs published a three-part technical dossier (January, February, and April 2026) reverse-engineering the post-exploitation "kernel engine" used by Intellexa's Predator commercial spyware on iOS devices predating iOS 17 (iPhone XS through iPhone 14 Pro Max, spanning five internally-numbered device classes 0-4, class 2 unused in the analyzed sample).

The April 2026 report (primary source for this record) details four core engineering components. FDGuardNeonRW is a kernel read/write primitive that abuses ARM NEON vector registers (V0-V31) as a covert, bidirectional data channel: reads load kernel data into NEON registers and trigger a trap that surfaces the data inside a Mach exception message (msgh_id 2406 / 0x966); writes suspend a thread, modify its NEON state at a device-class-specific offset, and replay it via an exception reply, polling up to 3 seconds (10 retries) to confirm the write landed. NEON registers were chosen for their size (512+ bits, enabling 528 bytes per read), their status as ordinary Mach-managed thread state, and their inclusion in exception messages by default. The engine pairs this with a PAC (Pointer Authentication Code) bypass targeting a 20-byte ARM64 gadget (built around a `PACIA X16, X17` instruction) located via `memmem()` near Safari/JavaScriptCore's `JSC::JSArrayBuffer::isShared()` symbol (resolved through `dlopen`/`dlsym`). Rather than re-signing pointers on every call, the malware pre-computes a 256-entry cache of signed pointers (512 total remotePACIA invocations, 256 addresses x 2 PC/LR discriminators), giving near-instant forged signatures for subsequent hooks. callFunc then builds a reusable remote-procedure-call framework: a "trojan thread" parked at a breakpoint in the target process continuously raises Mach exceptions; each exception is intercepted, argument registers x0-x5 are populated, the PAC cache supplies correctly signed PC/LR values, and a "poison LR" return address forces a second breakpoint so the trojan thread can be re-entered indefinitely. On devices without Developer Mode enabled, an internal class (`NSTaskROP::WithoutDeveloperMode`, source-referenced as `TaskROPDevOff.h`) falls back to ROP to reach the same effect. Four sequential callFunc invocations are used to walk the full Objective-C runtime method-resolution chain remotely, correctly handling per-process ASLR. Finally, RWTransfer shares the acquired kernel read/write capability between a "watcher" and a "helper" process: the watcher walks kernel-linked lists at device-class-specific offsets to locate the helper's task structure, then manipulates its IPC space and individual Mach port entries so both processes can operate with kernel-level access. Jamf notes that Apple's A15-and-later Secure Page Table Monitor (SPTM), which moves page-table management to EL2, is a significant architectural mitigation against the kernel-code-modification techniques described.

The January 2026 companion report documents the same engine's anti-analysis "kill switch": a `CSWatcherSpawner` class implements a granular error-code taxonomy (301-311, with 302/303/305/306 unused/reserved) that lets Intellexa operators diagnose exactly why a deployment failed -- root CA installation (301), security-tooling presence such as Frida/tcpdump (304), jailbreak (307), Developer Mode via `sysctlbyname("security.mac.amfi.developer_mode_status")` (308), US/IL locale (309), diagnosticd/console attachment via boot-time-vs-filter-mtime comparison (310), or multiple concurrent instances (311). On trigger, the implant reports the specific error code to its C2 infrastructure, then self-cleans by deleting its staging directory under `/private/var/tmp/` and registers for the `com.apple.springboard.deviceWillShutDown` Darwin notification to run cleanup on shutdown. For anti-forensics, it uses kqueue to watch the CrashReporter log directory and, on detecting a "SystemMemory" crash report (which could expose the implant to memory-dump analysis), SIGKILLs the `mmaintenanced` daemon to suppress it.

The February 2026 report details HiddenDot, a defense-evasion technique that hides iOS's camera (green) and microphone (orange) privacy indicator dots entirely. Rather than exploiting a new vulnerability, it abuses Objective-C messaging semantics: after gaining kernel-level access, the implant hooks `SBSensorActivityDataProvider._handleNewDomainData:` inside SpringBoard (via `HiddenDot::setupHook()`) and, using a single `STR XZR` ARM64 instruction, nulls the `self` pointer so the message-send is silently ignored -- SpringBoard never learns sensor activity changed, so neither indicator ever lights up. Because `SBSensorActivityDataProvider` aggregates all sensor activity, one hook suppresses both indicators simultaneously. Jamf also documents companion hooks in `mediaserverd`'s audio pipeline (`AudioConverterNew`, `AudioConverterConvertComplexBuffer+52`) tied to the `AudioToolboxCore.framework` and `CMCapture.framework`, consistent with the malware actively intercepting live camera/microphone media while the recording indicators are suppressed.

Jamf frames this dossier against Google Threat Intelligence Group's December 2025 report "Sanctioned but Still Spying," which documents Intellexa continuing to burn zero-days (15 of ~70 GTIG has tracked since 2021, spanning iOS, Android, and Chrome) and targeting political activists and government officials across Pakistan, Kazakhstan, Angola, Egypt, Uzbekistan, Saudi Arabia, Tajikistan, and a Mongolian government watering-hole -- despite the Intellexa Consortium (including Cytrox, the original Predator developer) being sanctioned by the US Treasury/OFAC in March 2024. GTIG describes an unrelated 2023 iOS exploit chain ("smack," captured with CitizenLab in Egypt, chaining CVE-2023-41993/41991/41992) that deploys a validator payload ("PREYHUNTER") before the full Predator implant; delivery has shifted from one-time links in encrypted messengers to malicious ads that fingerprint and redirect targets. This report does not itself cite a CVE, CVSS score, or specific in-the-wild victim for the FDGuardNeonRW/PAC-bypass/callFunc/RWTransfer engine -- it is malware-analysis documentation of previously undocumented post-exploitation tradecraft, not a fresh vulnerability disclosure.