A New Era of Mercenary Spyware
Predator is a commercial spyware platform designed to infiltrate mobile devices—most commonly iPhones and Android smartphones—and enable covert, continuous surveillance. Originally developed by Cytrox, an entity within the Intellexa network, Predator is engineered to bypass modern security protections and give operators near-total access to a victim’s digital life.
Key characteristics of Predator include:
-
Modular architecture that allows operators to deploy different capabilities depending on their goals.
-
Ability to run silently, without visible apps or notifications.
-
Sophisticated exploit chains, sometimes using multiple zero-day vulnerabilities.
-
Real-time monitoring, including live microphone and camera control.
-
Multi-platform targeting, expanding beyond early Android focus to include iOS devices.
Predator’s continued evolution demonstrates the growing resilience of mercenary spyware—even as global pressure intensifies.
Zero-Click Exploits
Google TAG reports that Predator has been used in zero-click attacks, meaning the victim does not need to take any action. These attacks often occur through:
- Messaging apps like WhatsApp
- Native SMS/MMS
- Push notifications
- Inbound calls
Because they require no user interaction, zero-click exploits are extremely difficult to detect or prevent.
One-Click Infection Links
One-click attacks are more common and rely on social engineering. Operators send malicious links disguised as:
- News articles
- Political updates
- URLs referencing journalists or civic organizations
- Personalized phishing messages created from public or stolen data
Once clicked, the link silently triggers the exploit chain.
Network Injection Attacks
These attacks occur when an operator can intercept traffic—often through compromised telecom infrastructure or access to local network providers. When the victim visits any HTTP site, malware is injected automatically.
Recorded Future has highlighted the use of Predator in regions with weaker telecommunications oversight, making network injection a high-risk threat in certain countries.
Highly Personalized Social Engineering
Amnesty International’s research shows attackers frequently impersonate:
- Journalists
- News organizations
- Government officials
- Trusted colleagues
Messages often reference real events, political issues, or personal details to increase credibility.
