# Predator Spyware: Undocumented iOS Kernel Exploitation Engine (FDGuardNeonRW, PAC Bypass, RWTransfer)

> Jamf Threat Labs reverse-engineered previously undocumented post-exploitation components of Intellexa's Predator commercial iOS spyware: a NEON-register kernel read/write covert channel (FDGuardNeonRW), a JavaScriptCore-based Pointer Authentication (PAC) bypass using a 256-entry pre-signed pointer cache, Mach-exception-based remote function execution (callFunc), and cross-process kernel capability transfer (RWTransfer). The same engine also powers a granular anti-analysis kill-switch and a SpringBoard hook (HiddenDot) that silently suppresses iOS's camera/microphone recording indicators.

- **Published:** 2026-04-10T00:00:00Z
- **Last reviewed:** 2026-04-10T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2046
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-predator-ios-kernel-engine-tl-2026-2046.webp?v=d29449c3 (Threadlinqs threat intel: Predator iOS Kernel Engine: Detection & IOCs (TL-2026-2046) — High severity, 10 IOCs, 9 detection rules.)
- **ID:** TL-2026-2046
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** Intellexa Consortium
- **Detections:** 9 (1 shown free below) · **IOCs:** 10

## Description

Jamf Threat Labs published a three-part technical dossier (January, February, and April 2026) reverse-engineering the post-exploitation "kernel engine" used by Intellexa's Predator commercial spyware on iOS devices predating iOS 17 (iPhone XS through iPhone 14 Pro Max, spanning five internally-numbered device classes 0-4, class 2 unused in the analyzed sample).

The April 2026 report (primary source for this record) details four core engineering components. FDGuardNeonRW is a kernel read/write primitive that abuses ARM NEON vector registers (V0-V31) as a covert, bidirectional data channel: reads load kernel data into NEON registers and trigger a trap that surfaces the data inside a Mach exception message (msgh_id 2406 / 0x966); writes suspend a thread, modify its NEON state at a device-class-specific offset, and replay it via an exception reply, polling up to 3 seconds (10 retries) to confirm the write landed. NEON registers were chosen for their size (512+ bits, enabling 528 bytes per read), their status as ordinary Mach-managed thread state, and their inclusion in exception messages by default. The engine pairs this with a PAC (Pointer Authentication Code) bypass targeting a 20-byte ARM64 gadget (built around a `PACIA X16, X17` instruction) located via `memmem()` near Safari/JavaScriptCore's `JSC::JSArrayBuffer::isShared()` symbol (resolved through `dlopen`/`dlsym`). Rather than re-signing pointers on every call, the malware pre-computes a 256-entry cache of signed pointers (512 total remotePACIA invocations, 256 addresses x 2 PC/LR discriminators), giving near-instant forged signatures for subsequent hooks. callFunc then builds a reusable remote-procedure-call framework: a "trojan thread" parked at a breakpoint in the target process continuously raises Mach exceptions; each exception is intercepted, argument registers x0-x5 are populated, the PAC cache supplies correctly signed PC/LR values, and a "poison LR" return address forces a second breakpoint so the trojan thread can be re-entered indefinitely. On devices without Developer Mode enabled, an internal class (`NSTaskROP::WithoutDeveloperMode`, source-referenced as `TaskROPDevOff.h`) falls back to ROP to reach the same effect. Four sequential callFunc invocations are used to walk the full Objective-C runtime method-resolution chain remotely, correctly handling per-process ASLR. Finally, RWTransfer shares the acquired kernel read/write capability between a "watcher" and a "helper" process: the watcher walks kernel-linked lists at device-class-specific offsets to locate the helper's task structure, then manipulates its IPC space and individual Mach port entries so both processes can operate with kernel-level access. Jamf notes that Apple's A15-and-later Secure Page Table Monitor (SPTM), which moves page-table management to EL2, is a significant architectural mitigation against the kernel-code-modification techniques described.

The January 2026 companion report documents the same engine's anti-analysis "kill switch": a `CSWatcherSpawner` class implements a granular error-code taxonomy (301-311, with 302/303/305/306 unused/reserved) that lets Intellexa operators diagnose exactly why a deployment failed -- root CA installation (301), security-tooling presence such as Frida/tcpdump (304), jailbreak (307), Developer Mode via `sysctlbyname("security.mac.amfi.developer_mode_status")` (308), US/IL locale (309), diagnosticd/console attachment via boot-time-vs-filter-mtime comparison (310), or multiple concurrent instances (311). On trigger, the implant reports the specific error code to its C2 infrastructure, then self-cleans by deleting its staging directory under `/private/var/tmp/` and registers for the `com.apple.springboard.deviceWillShutDown` Darwin notification to run cleanup on shutdown. For anti-forensics, it uses kqueue to watch the CrashReporter log directory and, on detecting a "SystemMemory" crash report (which could expose the implant to memory-dump analysis), SIGKILLs the `mmaintenanced` daemon to suppress it.

The February 2026 report details HiddenDot, a defense-evasion technique that hides iOS's camera (green) and microphone (orange) privacy indicator dots entirely. Rather than exploiting a new vulnerability, it abuses Objective-C messaging semantics: after gaining kernel-level access, the implant hooks `SBSensorActivityDataProvider._handleNewDomainData:` inside SpringBoard (via `HiddenDot::setupHook()`) and, using a single `STR XZR` ARM64 instruction, nulls the `self` pointer so the message-send is silently ignored -- SpringBoard never learns sensor activity changed, so neither indicator ever lights up. Because `SBSensorActivityDataProvider` aggregates all sensor activity, one hook suppresses both indicators simultaneously. Jamf also documents companion hooks in `mediaserverd`'s audio pipeline (`AudioConverterNew`, `AudioConverterConvertComplexBuffer+52`) tied to the `AudioToolboxCore.framework` and `CMCapture.framework`, consistent with the malware actively intercepting live camera/microphone media while the recording indicators are suppressed.

Jamf frames this dossier against Google Threat Intelligence Group's December 2025 report "Sanctioned but Still Spying," which documents Intellexa continuing to burn zero-days (15 of ~70 GTIG has tracked since 2021, spanning iOS, Android, and Chrome) and targeting political activists and government officials across Pakistan, Kazakhstan, Angola, Egypt, Uzbekistan, Saudi Arabia, Tajikistan, and a Mongolian government watering-hole -- despite the Intellexa Consortium (including Cytrox, the original Predator developer) being sanctioned by the US Treasury/OFAC in March 2024. GTIG describes an unrelated 2023 iOS exploit chain ("smack," captured with CitizenLab in Egypt, chaining CVE-2023-41993/41991/41992) that deploys a validator payload ("PREYHUNTER") before the full Predator implant; delivery has shifted from one-time links in encrypted messengers to malicious ads that fingerprint and redirect targets. This report does not itself cite a CVE, CVSS score, or specific in-the-wild victim for the FDGuardNeonRW/PAC-bypass/callFunc/RWTransfer engine -- it is malware-analysis documentation of previously undocumented post-exploitation tradecraft, not a fresh vulnerability disclosure.

## MITRE ATT&CK

- T1404 Exploitation for Privilege Escalation
- T1631 Process Injection
- T1617 Hooking
- T1630 Indicator Removal on Host
- T1630.002 File Deletion
- T1633.001 System Checks
- T1418.001 Security Software Discovery
- T1424 Process Discovery
- T1420 File and Directory Discovery
- T1426 System Information Discovery
- T1429 Audio Capture
- T1512 Video Capture

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Predator CSWatcherSpawner — Anti-Analysis Kill-Switch Error-Code Burst (301/304/307/308/309/310/311)** (`TL-2026-2046-SPL-002`)

Detects invocation of check_perform(), the CSWatcherSpawner entry point that sequentially runs Predator's full anti-analysis taxonomy — root CA detection (301), security-tooling detection e.g. Frida/tcpdump (304), jailbreak detection (307), Developer Mode detection via sysctlbyname (308), US/IL locale check (309), diagnosticd/console attachment detection (310), and multi-instance detection (311) — reported as a tight cluster of environment-check events immediately followed by implant self-termination behavior.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1633.001, T1418.001
- **Data sources:** jamf_protect_mtd_telemetry, mdm_compliance_events
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=jamf_protect sourcetype="jamf:protect:telemetry" event_type="anti_analysis_check" (function="check_perform" OR error_code IN (301,304,307,308,309,310,311))
| bin _time span=2m
| stats count as check_events values(error_code) as codes_seen dc(error_code) as code_variety by device_udid, _time
| where check_events >= 3 AND code_variety >= 2
| table _time device_udid check_events codes_seen code_variety
```

### Microsoft KQL

```kql
JamfProtectAlerts_CL
| where TimeGenerated > ago(24h)
| where EventType_s == "anti_analysis_check" and (FunctionName_s == "check_perform" or toint(ErrorCode_s) in (301,304,307,308,309,310,311))
| summarize CheckEvents = count(), CodesSeen = make_set(ErrorCode_s), CodeVariety = dcount(ErrorCode_s) by DeviceUdid_s, bin(TimeGenerated, 2m)
| where CheckEvents >= 3 and CodeVariety >= 2
| project TimeGenerated, DeviceUdid_s, CheckEvents, CodesSeen, CodeVariety
```

### Sigma

```yaml
title: Predator CSWatcherSpawner Anti-Analysis Kill-Switch Error-Code Burst
id: 1b6e4d29-8a3c-4f65-9d21-6c0e3b9a7f04
status: experimental
description: Detects a burst of CSWatcherSpawner check_perform() anti-analysis events reporting two or more of the documented error codes (301 root CA, 304 security tooling, 307 jailbreak, 308 Developer Mode, 309 US/IL locale, 310 diagnosticd attach, 311 multi-instance) within a short window — Predator's kill-switch diagnosing why deployment would fail.
references:
  - https://www.jamf.com/blog/predator-spyware-anti-analysis-techniques-ios-error-codes-detection/
author: Threadlinqs Team
date: 2026-08-17
tags:
  - attack.defense-evasion
  - attack.discovery
  - attack.t1633.001
  - attack.t1418.001
  - threat.predator
  - threat.intellexa
logsource:
  product: ios
  service: jamf_protect
detection:
  selection:
    EventType: anti_analysis_check
  selection_codes:
    ErrorCode:
      - 301
      - 304
      - 307
      - 308
      - 309
      - 310
      - 311
  timeframe: 2m
  condition: selection and selection_codes | count() by DeviceUdid >= 3 and count(distinct ErrorCode) by DeviceUdid >= 2
falsepositives:
  - MDM compliance scans or MTD self-tests that legitimately probe jailbreak/root-CA/Developer-Mode state can superficially resemble a single check_perform() pass; the code-variety threshold reduces this
level: high
```

**Known false positives:**

- Legitimate MDM compliance or MTD self-check routines that probe jailbreak/root-CA/Developer-Mode state in a single benign pass

**Tuning notes:** Require code_variety >= 2 to separate the malware's multi-check taxonomy sweep from a single legitimate compliance probe; add known MTD/MDM agent process names to an allowlist.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Predator JavaScriptCore PAC-Bypass Gadget Resolution & PACIA Forgery Cache Build-Out (locked: unlock with TL Creds)
- Predator Anti-Forensics — mmaintenanced SIGKILL Following CrashReporter kqueue Watch (locked: unlock with TL Creds)
- Predator HiddenDot — SpringBoard Hook Suppressing Camera/Microphone Recording Indicators (locked: unlock with TL Creds)
- Predator callFunc — Trojan-Thread Remote Procedure Call via Repeated Breakpoint Mach Exceptions (locked: unlock with TL Creds)
- Predator Implant Self-Cleanup — Staging Directory Deletion + Shutdown Darwin Notification Registration (locked: unlock with TL Creds)
- Predator mediaserverd Audio Pipeline Hook (AudioConverterConvertComplexBuffer+52) — Microphone Interception Companion to Indicator Suppression (locked: unlock with TL Creds)
- Predator FDGuardNeonRW — NEON Kernel R/W Covert Channel via Mach Exception Burst (locked: unlock with TL Creds)
- Predator RWTransfer — Cross-Process Kernel Capability Sharing (Watcher→Helper Mach Port/IPC Manipulation) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [Predator Spyware's iOS Kernel Exploitation Engine: PAC Bypass, NEON R/W & More](https://www.jamf.com/blog/predator-spyware-ios-kernel-exploitation-engine/)
- [Predator iOS Spyware: Undocumented Anti-Analysis Techniques](https://www.jamf.com/blog/predator-spyware-anti-analysis-techniques-ios-error-codes-detection/)
- [How Predator Spyware Defeats iOS Recording Indicators](https://www.jamf.com/blog/predator-spyware-ios-recording-indicator-bypass-analysis/)
- [Sanctioned but Still Spying: Intellexa's Prolific Zero-Day Exploits Continue](https://cloud.google.com/blog/topics/threat-intelligence/intellexa-zero-day-exploits-continue)
- [Treasury Sanctions Members of the Intellexa Consortium](https://home.treasury.gov/news/press-releases/jy2155)
- [Predator Spyware Stealthily Disables Camera and Microphone Indicators on iOS](https://www.thaicert.or.th/en/2026/02/23/predator-spyware-stealthily-disables-camera-and-microphone-indicators-on-ios/)
- [Intellexa's Predator spyware can hide iOS recording indicators while secretly streaming camera and microphone feeds](https://www.mactech.com/2026/02/25/intellexas-predator-spyware-can-hide-ios-recording-indicators-while-secretly-streaming-camera-and-microphone-feeds/)
- [Predator spyware hooks iOS SpringBoard to hide mic, camera activity](https://www.prsol.cc/2026/02/27/predator-spyware-hooks-ios-springboard-to-hide-mic-camera-activity/)
- [Predator in the Wires: Ahmed Eltantawy Targeted with Predator Spyware After Announcing Presidential Ambitions](https://citizenlab.ca/research/predator-in-the-wires-ahmed-eltantawy-targeted-with-predator-spyware-after-announcing-presidential-ambitions/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2046