106/69 Monday, February 23, 2026
Researchers from Jamf, a company specializing in mobile device management, have disclosed new technical details about the “Predator” spyware developed by Intellexa. The spyware is capable of bypassing a key Apple privacy feature by suppressing the recording indicators-the green and orange dots displayed in the iPhone’s status bar when the camera or microphone is in use. This technique allows Predator to secretly capture audio and video from targeted devices and transmit the data to its operators without alerting the victim, leaving no visible signs of abnormal activity on the home screen.
Technically, Predator does not rely on exploiting a newly discovered iOS vulnerability. Instead, it leverages previously obtained kernel-level access to hook into internal system processes. Specifically, it interferes with the SpringBoard process through a function known as HiddenDot::setupHook(). The spyware intercepts the _handleNewDomainData: method within the SBSensorActivityDataProvider component. When the camera or microphone is activated, the associated sensor status data is altered to null before being passed to the user interface (UI), preventing the system from triggering the visual recording indicators. This effectively neutralizes a privacy safeguard Apple has implemented since iOS 14.
Although the spyware is highly sophisticated and designed to evade detection by ordinary users, researchers note that signs of compromise may still be identified through forensic analysis, such as detecting abnormal memory mapping behavior or unusual audio files created in atypical system paths. Intellexa has been sanctioned by the United States and has a history of selling surveillance tools to various entities worldwide. As of now, Apple has not issued an official statement regarding the findings. The case highlights the ongoing efforts of commercial spyware developers to circumvent advanced security protections.
