{
  "family": "predator",
  "sample_count": 9,
  "category": "advanced_threat",
  "description": "Spyware:Android/Predator (also affecting iOS) is a highly sophisticated, commercial mercenary spyware suite developed by Cytrox (part of the Intellexa alliance). Similar to the infamous Pegasus spyware (by NSO Group), Predator is sold exclusively to nation-states and intelligence agencies. It is used in highly targeted, zero-click or one-click attacks against journalists, dissidents, politicians, and high-value corporate targets to achieve total device compromise.<br><br><b>Understanding Predator Spyware</b><br>To a victim, a Predator infection is completely invisible; there are no pop-ups, no performance drops, and no suspicious apps. For security researchers, identifying Predator requires advanced mobile forensics. It represents the absolute pinnacle of targeted cyber-espionage, providing the attacker with unrestricted, real-time access to the device's microphone, camera, encrypted messaging apps (WhatsApp, Signal), and location data.<br><br><b>Execution and Exploit Chains</b><br>Predator is almost always deployed via complex chains of zero-day exploits. The most common vector is a 'One-Click' attack (`T1566.001`) where the target receives an SMS or WhatsApp message containing a shortened link (often spoofing a news article or package delivery). When clicked, the link directs the device's browser to an exploitation server. The server delivers a chain of exploits (`T1203`)—first compromising the browser (e.g., Chrome or Safari), then escaping the browser sandbox, and finally escalating privileges to root/SYSTEM level (`T1068`). Once rooted, the Predator payload is injected entirely into memory (`T1055`), avoiding the file system to evade forensic detection. It establishes deep persistence, often surviving reboots by compromising the bootloader or persisting in the baseband processor.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is the complete and total loss of privacy and security on the mobile device. Detecting Predator requires specialized forensic analysis of the device's syslogs, battery usage statistics (looking for anomalous power draw by system processes), and network traffic analysis. A key forensic IoC is the presence of unusual crash logs related to the browser or core system services (indicating the exploit chain was triggered). The command and control infrastructure is highly dynamic and obfuscated, often utilizing domain fronting or compromised legitimate infrastructure.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1068",
    "T1125",
    "T1636",
    "T1203"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1203",
      "name": "Exploitation for Client Execution (Zero-day browser exploit chains)",
      "tactic": "Execution"
    },
    {
      "id": "T1068",
      "name": "Exploitation for Privilege Escalation (Escaping sandbox and gaining root)",
      "tactic": "Privilege Escalation"
    },
    {
      "id": "T1125",
      "name": "Video/Audio Capture (Accessing device microphone and camera)",
      "tactic": "Collection"
    },
    {
      "id": "T1636",
      "name": "Data from Information Repositories (Extracting WhatsApp/Signal messages)",
      "tactic": "Collection"
    }
  ],
  "containment_steps": [
    "If Predator is suspected on a high-value target's device, immediately turn off the device and place it in a Faraday bag to sever all remote connections.",
    "Do not attempt to 'clean' the device; it must be preserved for expert forensic analysis by specialized incident response teams.",
    "Assume all communications (including end-to-end encrypted chats), passwords, and MFA tokens on the device have been fully compromised.",
    "Provide the target with a completely new, clean device, and rotate all credentials associated with the compromised phone."
  ],
  "what_to_avoid": [
    "Do not assume a factory reset will remove Predator; advanced mercenary spyware frequently achieves persistence at the bootloader or firmware level.",
    "Avoid plugging the compromised device into a corporate network or computer, as it may attempt lateral movement or data exfiltration."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}