Inside Predator: The Spyware Kingpin Exploiting iPhones with a Barrage of Zero-Day Attacks

In the cat-and-mouse world of cyber espionage, few names inspire as much dread as Intellexa-the brains behind Predator spyware. Despite mounting sanctions and relentless research exposure, this elusive surveillance firm has orchestrated a relentless campaign of zero-day attacks against iOS devices, putting both privacy and global cybersecurity on edge.

Predator’s Relentless Zero-Day Barrage

According to Google’s Threat Intelligence Group (GTIG), Intellexa has been responsible for at least 15 zero-day vulnerabilities-security holes unknown to vendors-since 2021. To put this in perspective, that’s more than 20% of all mobile zero-days tracked by Google’s teams over the last three years. These aren’t garden-variety bugs; they’re severe flaws like remote code execution (RCE), where attackers run malicious code on a victim’s device, and privilege escalation, letting them seize deep system control.

The technical sophistication is striking. Intellexa’s exploits have targeted everything from Chrome’s V8 JavaScript engine to the core of Apple’s iOS kernel. Notable examples include CVE-2023-41993 (a flaw in Safari’s WebKit) and CVE-2023-41992 (a kernel-level escape). All were patched after discovery, but only after attackers had already slipped through the cracks.

In one Egyptian campaign, researchers captured a full exploit chain-codenamed “smack”-that chained together multiple vulnerabilities to infect targets with Predator spyware. The operation’s modular “JSKit” framework allowed code to execute directly from memory, sidestepping Apple’s security features like Pointer Authentication Codes. The final payload, dubbed PREYHUNTER, included stealthy checks to evade detection by anti-virus software and even avoided activating if it detected a U.S. or Israeli locale.

Delivery Tactics and Global Response

Traditionally, Predator infections started with one-time links sent over encrypted messaging apps. But Intellexa has raised the stakes, hijacking online advertising platforms to silently profile users and redirect potential targets to exploit servers. Google and partners have since moved to block these ad accounts, but the threat remains.

Hundreds of individuals-many in politically sensitive regions-have received “government-backed attack” warnings from Google. All known malicious domains are now on Safe Browsing blocklists, but the broader battle against commercial spyware is far from over.

International coalitions, such as the Pall Mall Process, are racing to rein in companies like Intellexa. But as long as the demand for surveillance tech persists, the cat-and-mouse game will continue.