Predator Spyware: How iOS Indicators Were Silenced

Researchers have uncovered how Intellexa’s Predator spyware manipulates iOS to hide camera and microphone activity indicators, allowing operators to secretly stream feeds without alerting the user.

Background

• Apple introduced recording indicators in iOS 14:
  • Green dot → Camera in use.
  • Orange dot → Microphone in use.
• These indicators are designed to protect privacy by showing when sensors are active.
• Predator, a commercial spyware tool delivered via zero‑click exploits and zero‑day flaws, bypasses this safeguard.

How Predator Hides Activity

Jamf researchers analyzed Predator samples and documented the stealth mechanism:

• Predator hooks into SpringBoard, the iOS system responsible for UI elements.
• A function called HiddenDot::setupHook() intercepts sensor activity changes.
• By nullifying the SBSensorActivityDataProvider object, Predator prevents updates from reaching the UI layer.
• Result: the green/orange dots never appear, even when the camera or microphone is recording.

Key points:

• One hook disables both camera and microphone indicators.
• “Dead code” suggests earlier attempts to hook SBRecordingIndicatorManager, later abandoned.
• For VoIP recordings, Predator relies on the same HiddenDot function for stealth.
• Camera access is enabled via ARM64 instruction pattern matching and PAC redirection, bypassing permission checks.

Implications

• Complete invisibility: Users cannot see when their camera or microphone is active.
• Surveillance risk: Operators can secretly stream video/audio without detection.
• Technical traces: Signs of Predator activity include unusual memory mappings, breakpoint hooks, and audio files written to unexpected paths.

Defensive Takeaways

• Indicators alone aren’t enough: Advanced spyware can bypass UI‑level protections.
• Behavioral monitoring: Enterprises should track anomalies in system processes (SpringBoard, mediaserverd).
• Layered defense: Combine OS‑level protections with mobile threat defense solutions.
• Awareness: Users should understand that indicators are helpful but not foolproof against sophisticated spyware.

Final Thought

Predator’s ability to suppress iOS privacy indicators underscores the arms race between surveillance tools and security safeguards. While Apple’s indicators were a step forward in transparency, attackers continue to innovate ways to bypass them. For defenders, the lesson is clear: privacy protections must extend beyond the UI into deeper system monitoring and anomaly detection.