Predator spyware bypasses iOS recording indicators

As reported by Bleeping Computer, Intellexa's Predator spyware has been found to circumvent iOS recording indicators, allowing it to secretly stream camera and microphone feeds without user detection. This sophisticated technique does not rely on exploiting iOS vulnerabilities but rather on manipulating existing system functions.

Researchers at Jamf have detailed how Predator achieves this stealth by hooking a specific function within the SpringBoard application. This hook intercepts sensor activity updates before they reach the user interface, preventing the familiar green or orange dots that signal camera or microphone use from appearing. The spyware achieves this by nullifying an object responsible for sensor data, causing iOS to silently ignore these updates.

While Predator also supports VoIP recordings, it relies on the same indicator-suppression mechanism for stealth. Camera access is facilitated through a separate module that bypasses permission checks. Technical analysis reveals anomalies such as unexpected memory mappings and breakpoint-based hooks, indicating the presence of malicious processes.

Source: Bleeping Computer