Skip to navigation

Threat reportMalwareTL-2026-2046

Predator Spyware: Undocumented iOS Kernel Exploitation Engine (FDGuardNeonRW, PAC Bypass, RWTransfer)

highACTIVE

Jamf Threat Labs reverse-engineered previously undocumented post-exploitation components of Intellexa's Predator commercial iOS spyware: a NEON-register kernel read/write covert channel (FDGuardNeonRW), a JavaScriptCore-based Pointer Authentication (PAC) bypass using a 256-entry pre-signed pointer cache, Mach-exception-based remote function execution (callFunc), and cross-process kernel capability transfer (RWTransfer).

Key facts

IdentifiersTL-2026-2046
Also known asFDGuardNeonRW, RWTransfer, callFunc, HiddenDot
SeverityHIGH
Affected productsApple iOS
AttributionIntellexa Consortium (high confidence)
MITRE ATT&CK techniquesT1404 Exploitation for Privilege Escalation, T1418.001 Security Software Discovery, T1420 File and Directory Discovery, T1424 Process Discovery, T1426 System Information Discovery, T1429 Audio Capture, T1512 Video Capture, T1617 Hooking, T1630 Indicator Removal on Host, T1630.002 File Deletion, T1631 Process Injection, T1633.001 System Checks
MotivationESPIONAGE
Target sectorsgovernment administration, civil society
Target regionspakistan, kazakhstan, angola, egypt, uzbekistan, saudi arabia, tajikistan, mongolia
Detection rules9 (1 shown free)
Sources9 cited sources

Detection coverage

As of 2026-04-10, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2046 across Splunk SPL, Microsoft KQL and Sigma, covering 10 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Predator CSWatcherSpawner — Anti-Analysis Kill-Switch Error-Code Burst (301/304/307/308/309/310/311)

Detects invocation of check_perform(), the CSWatcherSpawner entry point that sequentially runs Predator's full anti-analysis taxonomy — root CA detection (301), security-tooling detection e.g. Frida/tcpdump (304), jailbreak detection (307), Developer Mode detection via sysctlbyname (308), US/IL locale check (309), diagnosticd/console attachment detection (310), and multi-instance detection (311) — reported as a tight cluster of environment-check events immediately followed by implant self-termination behavior.

  • Languages: Splunk SPL, Microsoft KQL, Sigma
  • ATT&CK: T1633.001, T1418.001
  • Data sources: jamf_protect_mtd_telemetry, mdm_compliance_events
  • Severity: high
  • Confidence: high

Splunk SPL

index=jamf_protect sourcetype="jamf:protect:telemetry" event_type="anti_analysis_check" (function="check_perform" OR error_code IN (301,304,307,308,309,310,311))
| bin _time span=2m
| stats count as check_events values(error_code) as codes_seen dc(error_code) as code_variety by device_udid, _time
| where check_events >= 3 AND code_variety >= 2
| table _time device_udid check_events codes_seen code_variety

Microsoft KQL

JamfProtectAlerts_CL
| where TimeGenerated > ago(24h)
| where EventType_s == "anti_analysis_check" and (FunctionName_s == "check_perform" or toint(ErrorCode_s) in (301,304,307,308,309,310,311))
| summarize CheckEvents = count(), CodesSeen = make_set(ErrorCode_s), CodeVariety = dcount(ErrorCode_s) by DeviceUdid_s, bin(TimeGenerated, 2m)
| where CheckEvents >= 3 and CodeVariety >= 2
| project TimeGenerated, DeviceUdid_s, CheckEvents, CodesSeen, CodeVariety

Sigma

title: Predator CSWatcherSpawner Anti-Analysis Kill-Switch Error-Code Burst
id: 1b6e4d29-8a3c-4f65-9d21-6c0e3b9a7f04
status: experimental
description: Detects a burst of CSWatcherSpawner check_perform() anti-analysis events reporting two or more of the documented error codes (301 root CA, 304 security tooling, 307 jailbreak, 308 Developer Mode, 309 US/IL locale, 310 diagnosticd attach, 311 multi-instance) within a short window — Predator's kill-switch diagnosing why deployment would fail.
references:
  - https://www.jamf.com/blog/predator-spyware-anti-analysis-techniques-ios-error-codes-detection/
author: Threadlinqs Team
date: 2026-08-17
tags:
  - attack.defense-evasion
  - attack.discovery
  - attack.t1633.001
  - attack.t1418.001
  - threat.predator
  - threat.intellexa
logsource:
  product: ios
  service: jamf_protect
detection:
  selection:
    EventType: anti_analysis_check
  selection_codes:
    ErrorCode:
      - 301
      - 304
      - 307
      - 308
      - 309
      - 310
      - 311
  timeframe: 2m
  condition: selection and selection_codes | count() by DeviceUdid >= 3 and count(distinct ErrorCode) by DeviceUdid >= 2
falsepositives:
  - MDM compliance scans or MTD self-tests that legitimately probe jailbreak/root-CA/Developer-Mode state can superficially resemble a single check_perform() pass; the code-variety threshold reduces this
level: high

Known false positives:

  • Legitimate MDM compliance or MTD self-check routines that probe jailbreak/root-CA/Developer-Mode state in a single benign pass

Tuning notes: Require code_variety >= 2 to separate the malware's multi-check taxonomy sweep from a single legitimate compliance probe; add known MTD/MDM agent process names to an allowlist.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • Predator JavaScriptCore PAC-Bypass Gadget Resolution & PACIA Forgery Cache Build-Out · unlock with TL Creds
  • Predator Anti-Forensics — mmaintenanced SIGKILL Following CrashReporter kqueue Watch · unlock with TL Creds
  • Predator HiddenDot — SpringBoard Hook Suppressing Camera/Microphone Recording Indicators · unlock with TL Creds
  • Predator callFunc — Trojan-Thread Remote Procedure Call via Repeated Breakpoint Mach Exceptions · unlock with TL Creds
  • Predator Implant Self-Cleanup — Staging Directory Deletion + Shutdown Darwin Notification Registration · unlock with TL Creds
  • Predator mediaserverd Audio Pipeline Hook (AudioConverterConvertComplexBuffer+52) — Microphone Interception Companion to Indicator Suppression · unlock with TL Creds
  • Predator FDGuardNeonRW — NEON Kernel R/W Covert Channel via Mach Exception Burst · unlock with TL Creds
  • Predator RWTransfer — Cross-Process Kernel Capability Sharing (Watcher→Helper Mach Port/IPC Manipulation) · unlock with TL Creds

Indicators of compromise

As of 2026-04-10, Threadlinqs Intelligence tracks 10 indicators of compromise for TL-2026-2046.

10 indicators of compromise · unlock with TL Creds. Compare plans

Technical analysis

The same engine also powers a granular anti-analysis kill-switch and a SpringBoard hook (HiddenDot) that silently suppresses iOS's camera/microphone recording indicators.

Jamf Threat Labs published a three-part technical dossier (January, February, and April 2026) reverse-engineering the post-exploitation "kernel engine" used by Intellexa's Predator commercial spyware on iOS devices predating iOS 17 (iPhone XS through iPhone 14 Pro Max, spanning five internally-numbered device classes 0-4, class 2 unused in the analyzed sample).

The April 2026 report (primary source for this record) details four core engineering components. FDGuardNeonRW is a kernel read/write primitive that abuses ARM NEON vector registers (V0-V31) as a covert, bidirectional data channel: reads load kernel data into NEON registers and trigger a trap that surfaces the data inside a Mach exception message (msgh_id 2406 / 0x966); writes suspend a thread, modify its NEON state at a device-class-specific offset, and replay it via an exception reply, polling up to 3 seconds (10 retries) to confirm the write landed. NEON registers were chosen for their size (512+ bits, enabling 528 bytes per read), their status as ordinary Mach-managed thread state, and their inclusion in exception messages by default. The engine pairs this with a PAC (Pointer Authentication Code) bypass targeting a 20-byte ARM64 gadget (built around a `PACIA X16, X17` instruction) located via `memmem()` near Safari/JavaScriptCore's `JSC::JSArrayBuffer::isShared()` symbol (resolved through `dlopen`/`dlsym`). Rather than re-signing pointers on every call, the malware pre-computes a 256-entry cache of signed pointers (512 total remotePACIA invocations, 256 addresses x 2 PC/LR discriminators), giving near-instant forged signatures for subsequent hooks. callFunc then builds a reusable remote-procedure-call framework: a "trojan thread" parked at a breakpoint in the target process continuously raises Mach exceptions; each exception is intercepted, argument registers x0-x5 are populated, the PAC cache supplies correctly signed PC/LR values, and a "poison LR" return address forces a second breakpoint so the trojan thread can be re-entered indefinitely. On devices without Developer Mode enabled, an internal class (`NSTaskROP::WithoutDeveloperMode`, source-referenced as `TaskROPDevOff.h`) falls back to ROP to reach the same effect. Four sequential callFunc invocations are used to walk the full Objective-C runtime method-resolution chain remotely, correctly handling per-process ASLR. Finally, RWTransfer shares the acquired kernel read/write capability between a "watcher" and a "helper" process: the watcher walks kernel-linked lists at device-class-specific offsets to locate the helper's task structure, then manipulates its IPC space and individual Mach port entries so both processes can operate with kernel-level access. Jamf notes that Apple's A15-and-later Secure Page Table Monitor (SPTM), which moves page-table management to EL2, is a significant architectural mitigation against the kernel-code-modification techniques described.

The January 2026 companion report documents the same engine's anti-analysis "kill switch": a `CSWatcherSpawner` class implements a granular error-code taxonomy (301-311, with 302/303/305/306 unused/reserved) that lets Intellexa operators diagnose exactly why a deployment failed -- root CA installation (301), security-tooling presence such as Frida/tcpdump (304), jailbreak (307), Developer Mode via `sysctlbyname("security.mac.amfi.developer_mode_status")` (308), US/IL locale (309), diagnosticd/console attachment via boot-time-vs-filter-mtime comparison (310), or multiple concurrent instances (311). On trigger, the implant reports the specific error code to its C2 infrastructure, then self-cleans by deleting its staging directory under `/private/var/tmp/` and registers for the `com.apple.springboard.deviceWillShutDown` Darwin notification to run cleanup on shutdown. For anti-forensics, it uses kqueue to watch the CrashReporter log directory and, on detecting a "SystemMemory" crash report (which could expose the implant to memory-dump analysis), SIGKILLs the `mmaintenanced` daemon to suppress it.

The February 2026 report details HiddenDot, a defense-evasion technique that hides iOS's camera (green) and microphone (orange) privacy indicator dots entirely. Rather than exploiting a new vulnerability, it abuses Objective-C messaging semantics: after gaining kernel-level access, the implant hooks `SBSensorActivityDataProvider._handleNewDomainData:` inside SpringBoard (via `HiddenDot::setupHook()`) and, using a single `STR XZR` ARM64 instruction, nulls the `self` pointer so the message-send is silently ignored -- SpringBoard never learns sensor activity changed, so neither indicator ever lights up. Because `SBSensorActivityDataProvider` aggregates all sensor activity, one hook suppresses both indicators simultaneously. Jamf also documents companion hooks in `mediaserverd`'s audio pipeline (`AudioConverterNew`, `AudioConverterConvertComplexBuffer+52`) tied to the `AudioToolboxCore.framework` and `CMCapture.framework`, consistent with the malware actively intercepting live camera/microphone media while the recording indicators are suppressed.

Jamf frames this dossier against Google Threat Intelligence Group's December 2025 report "Sanctioned but Still Spying," which documents Intellexa continuing to burn zero-days (15 of ~70 GTIG has tracked since 2021, spanning iOS, Android, and Chrome) and targeting political activists and government officials across Pakistan, Kazakhstan, Angola, Egypt, Uzbekistan, Saudi Arabia, Tajikistan, and a Mongolian government watering-hole -- despite the Intellexa Consortium (including Cytrox, the original Predator developer) being sanctioned by the US Treasury/OFAC in March 2024. GTIG describes an unrelated 2023 iOS exploit chain ("smack," captured with CitizenLab in Egypt, chaining CVE-2023-41993/41991/41992) that deploys a validator payload ("PREYHUNTER") before the full Predator implant; delivery has shifted from one-time links in encrypted messengers to malicious ads that fingerprint and redirect targets. This report does not itself cite a CVE, CVSS score, or specific in-the-wild victim for the FDGuardNeonRW/PAC-bypass/callFunc/RWTransfer engine -- it is malware-analysis documentation of previously undocumented post-exploitation tradecraft, not a fresh vulnerability disclosure.

MITRE ATT&CK techniques by tactic:

Privilege Escalation

T1404 Exploitation for Privilege Escalation

Discovery

T1418.001 Security Software Discovery; T1420 File and Directory Discovery; T1424 Process Discovery; T1426 System Information Discovery

Collection

T1429 Audio Capture; T1512 Video Capture

Defense Evasion

T1617 Hooking; T1630 Indicator Removal on Host; T1630.002 File Deletion; T1631 Process Injection; T1633.001 System Checks

Remediation

Patches

  • No CVE or vendor patch is cited for the FDGuardNeonRW/PAC-bypass/callFunc/RWTransfer engine itself; mitigation depends on Apple's underlying Pointer Authentication and kernel code-integrity architecture and the newer SPTM hardware mitigation on A15+/iOS 17+

Immediate actions

  • Prioritize upgrading vulnerable devices (iPhone XS through iPhone 14 Pro Max) to iOS 17+; devices with A15-or-later silicon additionally gain Apple's Secure Page Table Monitor (SPTM), described by Jamf as a significant architectural mitigation against the kernel code-modification techniques used here
  • Enable Apple's Lockdown Mode for journalists, activists, dissidents, and government officials at elevated risk of mercenary-spyware targeting
  • Do not treat the absence of a camera/microphone recording indicator as proof recording is not occurring -- HiddenDot specifically suppresses that signal after kernel compromise
  • Preserve and review CrashReporter logs and unexpected daemon terminations (e.g., mmaintenanced being killed) as forensic evidence of anti-forensics behavior

Workarounds

  • Enable Lockdown Mode
  • Reboot devices regularly, which can disrupt non-persistent spyware implants
  • Be cautious of one-time links received via end-to-end encrypted messaging apps from unknown or unexpected senders, a documented Predator delivery vector

Longer-term hardening

  • Deploy Mobile Threat Defense/MDM tooling capable of flagging anomalous kernel state, unexpected SpringBoard/mediaserverd hooking, or the documented CSWatcherSpawner error-code behavior pattern
  • Track Jamf Threat Labs' and GTIG's ongoing Predator/Intellexa research for newly disclosed exploit chains and IOCs
  • Support continued sanctions enforcement and legal action against commercial spyware vendors operating despite OFAC designation

Affected and fixed versions

  • Apple — iOS
    Vulnerable versions: iOS versions prior to iOS 17, iPhone XS through iPhone 14 Pro Max (device classes 0-4, class 2 unused in analyzed sample)
    Fixed in: iOS 17+ on A15-or-later chips gains Secure Page Table Monitor (SPTM) hardware mitigation; no traditional CVE patch applies to this post-exploitation tooling

Timeline

  • Apple releases the iPhone XS, the oldest device (internally-numbered device class 0) within the affected range documented in Jamf's kernel-engine analysis.
  • Apple releases the iPhone 14 Pro Max, the newest device (device class 4) within the affected range documented in Jamf's kernel-engine analysis.
  • Citizen Lab, with Google's Threat Analysis Group, publishes 'Predator in the Wires,' documenting the unrelated prior 'smack' iOS zero-day exploit chain (CVE-2023-41993 WebKit RCE, CVE-2023-41991 code-signing bypass, CVE-2023-41992 kernel IPC use-after-free) used to deploy Predator against Egyptian presidential candidate Ahmed Eltantawy -- background tradecraft from the same threat actor, distinct from the FDGuardNeonRW/PAC-bypass engine documented in this record.
  • US Treasury/OFAC sanctions members of the Intellexa Consortium, including Cytrox, for developing and distributing Predator spyware used against journalists, activists, and government officials.
  • Per Google Threat Intelligence Group, Intellexa exploits CVE-2025-6554 (a Chrome V8 type-confusion vulnerability) against targets in Saudi Arabia -- the most recent of 15 zero-days GTIG attributes to Intellexa since 2021, showing continued operation despite the March 2024 sanctions.
  • Google Threat Intelligence Group publishes 'Sanctioned but Still Spying,' documenting Intellexa's continued zero-day exploitation and Predator deployments despite March 2024 US Treasury sanctions.
  • Jamf Threat Labs publishes the first report in its Predator kernel-engine series, detailing the CSWatcherSpawner anti-analysis error-code kill-switch and anti-forensics behavior.
  • Jamf Threat Labs publishes the second report, detailing the HiddenDot SpringBoard hook that suppresses iOS's camera and microphone recording indicators.
  • TL-Intel Harness ingests the Jamf Threat Labs report via RSS feed monitoring and opens threat TL-2026-2046.
  • Jamf Threat Labs publishes the primary report detailing FDGuardNeonRW (NEON-register kernel R/W covert channel), the JavaScriptCore PAC-bypass cache, callFunc remote execution, and RWTransfer cross-process kernel capability sharing.

Sources cited

More from Intellexa Consortium

Previous and next in malware

Drafted by the Threadlinqs research pipeline from 9 sources; published ; last updated —.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats