Predator

Overview

Spyware:Android/Predator (also affecting iOS) is a highly sophisticated, commercial mercenary spyware suite developed by Cytrox (part of the Intellexa alliance). Similar to the infamous Pegasus spyware (by NSO Group), Predator is sold exclusively to nation-states and intelligence agencies. It is used in highly targeted, zero-click or one-click attacks against journalists, dissidents, politicians, and high-value corporate targets to achieve total device compromise.

Understanding Predator Spyware
To a victim, a Predator infection is completely invisible; there are no pop-ups, no performance drops, and no suspicious apps. For security researchers, identifying Predator requires advanced mobile forensics. It represents the absolute pinnacle of targeted cyber-espionage, providing the attacker with unrestricted, real-time access to the device's microphone, camera, encrypted messaging apps (WhatsApp, Signal), and location data.

Execution and Exploit Chains
Predator is almost always deployed via complex chains of zero-day exploits. The most common vector is a 'One-Click' attack (`T1566.001`) where the target receives an SMS or WhatsApp message containing a shortened link (often spoofing a news article or package delivery). When clicked, the link directs the device's browser to an exploitation server. The server delivers a chain of exploits (`T1203`)—first compromising the browser (e.g., Chrome or Safari), then escaping the browser sandbox, and finally escalating privileges to root/SYSTEM level (`T1068`). Once rooted, the Predator payload is injected entirely into memory (`T1055`), avoiding the file system to evade forensic detection. It establishes deep persistence, often surviving reboots by compromising the bootloader or persisting in the baseband processor.

Indicators of Compromise & Impact
The impact is the complete and total loss of privacy and security on the mobile device. Detecting Predator requires specialized forensic analysis of the device's syslogs, battery usage statistics (looking for anomalous power draw by system processes), and network traffic analysis. A key forensic IoC is the presence of unusual crash logs related to the browser or core system services (indicating the exploit chain was triggered). The command and control infrastructure is highly dynamic and obfuscated, often utilizing domain fronting or compromised legitimate infrastructure.

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to the MITRE ATT&CK framework:

Tactical Mitigations

Based on the techniques used by this family, consider the following defensive strategies:

• T1125: Restrict access to local camera or microphone APIs. Utilize endpoint protection that monitors hardware access.

Generated Detections (Boilerplate)

These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.

YARA Rule

rule MALWARE_WIN_PREDATOR {
    meta:
        description = "Detects Predator (advanced_threat)"
        author = "SystemHelpdesk Boilerplate Generator"
        date = "2026-07-06"
    strings:
        $s1 = "predator" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

Sigma Rule

title: Suspicious Predator Activity
id: a573f12ada396d2ff2f87ce41764427c
status: experimental
description: Detects generic indicators of the predator malware family.
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
        CommandLine|contains:
            - "*predator*"
    condition: selection
level: medium

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. If Predator is suspected on a high-value target's device, immediately turn off the device and place it in a Faraday bag to sever all remote connections.
2. Do not attempt to 'clean' the device; it must be preserved for expert forensic analysis by specialized incident response teams.
3. Assume all communications (including end-to-end encrypted chats), passwords, and MFA tokens on the device have been fully compromised.
4. Provide the target with a completely new, clean device, and rotate all credentials associated with the compromised phone.

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not assume a factory reset will remove Predator; advanced mercenary spyware frequently achieves persistence at the bootloader or firmware level.
2. Avoid plugging the compromised device into a corporate network or computer, as it may attempt lateral movement or data exfiltration.

References & External Analysis

• Search "predator" on VirusTotal (External Analysis)

Frequently Asked Questions

Related Families (Category: advanced_threat)

Explore other malware families in the same category:

• Sogou
• Funshion
• Downloadshield
• Ulpm
• Gameol

Machine-readable

Get this profile as JSON: https://jordanricky1604-ship-it.github.io/malware-families-catalog/api/predator.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.