{
  "family": "predator",
  "sample_count": 120,
  "category": "spyware",
  "description": "Predator is a premier commercial zero-day mercenary spyware platform engineered by Cytrox (part of the European surveillance consortium known as the Intellexa Alliance). Discovered and documented by The Citizen Lab and Google's Threat Analysis Group (TAG), Predator has been weaponized by government customers to conduct covert surveillance against high-profile journalists, political opposition figures, human rights defenders, and European Parliament officials. Predator is delivered through precision one-click links (dispatched via SMS, WhatsApp, or Telegram) or zero-click network injection attacks that exploit sophisticated multi-vulnerability exploit chains in mobile web rendering engines (such as WebKit zero-days CVE-2023-41991, CVE-2023-41992, and CVE-2023-41993 on iOS, as well as Chrome flaws on Android). Once implanted on a victim device, Predator operates with kernel-level or root privileges. It provides operators with total surveillance access: recording live ambient audio via device microphones, activating cameras, tracking real-time GPS locations, capturing screen contents, and decrypting communications from end-to-end encrypted messaging applications (including Signal, Telegram, and WhatsApp) directly from device memory before encryption.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [
    "Predator Spyware",
    "Cytrox Predator",
    "Intellexa Predator",
    "Alien/Predator",
    "Spyware:Android/Predator"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Predator spyware?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Predator is an advanced commercial mobile surveillance platform developed by Cytrox/Intellexa that enables complete remote control and data interception on compromised iOS and Android smartphones."
      }
    },
    {
      "@type": "Question",
      "name": "How is Predator spyware delivered onto smartphones?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Predator is typically delivered via tailored spear-phishing messages containing malicious one-click URLs or via MITM network injection that redirect browsers through exploit chains targeting WebKit or Chrome."
      }
    },
    {
      "@type": "Question",
      "name": "Can Predator spyware read encrypted Signal and WhatsApp messages?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Yes. Because Predator operates with root privileges on the device operating system, it intercepts messages and audio before encryption occurs in the application layer."
      }
    },
    {
      "@type": "Question",
      "name": "What vulnerabilities were used to deploy Predator?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Predator exploit chains have weaponized multiple zero-day vulnerabilities including Apple iOS flaws CVE-2023-41991 (security framework bypass), CVE-2023-41992 (kernel privilege escalation), and CVE-2023-41993 (WebKit remote code execution)."
      }
    },
    {
      "@type": "Question",
      "name": "How can high-risk individuals protect against Predator spyware?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "High-risk users should enable Apple's Lockdown Mode (which severely restricts WebKit attack surface), keep device operating systems updated, reboot devices daily, and use Mobile Device Management (MDM) with verified security profiles."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1190",
    "T1203",
    "T1068",
    "T1125",
    "T1123",
    "T1056.001",
    "T1071.001",
    "T1041"
  ],
  "mitre_attack_detail": [
    {
      "id": "T1190",
      "name": "Exploit Public-Facing Application",
      "tactic": "initial-access"
    },
    {
      "id": "T1203",
      "name": "Exploitation for Client Execution",
      "tactic": "execution"
    },
    {
      "id": "T1068",
      "name": "Exploitation for Privilege Escalation",
      "tactic": "privilege-escalation"
    },
    {
      "id": "T1125",
      "name": "Video Capture",
      "tactic": "collection"
    },
    {
      "id": "T1123",
      "name": "Audio Capture",
      "tactic": "collection"
    },
    {
      "id": "T1056.001",
      "name": "Keylogging",
      "tactic": "credential-access"
    },
    {
      "id": "T1071.001",
      "name": "Web Protocols",
      "tactic": "command-and-control"
    },
    {
      "id": "T1041",
      "name": "Exfiltration Over C2 Channel",
      "tactic": "exfiltration"
    }
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-16",
  "first_seen": 2019,
  "lineage": {
    "derived_from": [
      "cytrox surveillance framework"
    ],
    "variants": [
      "predator ios implant",
      "predator android implant"
    ]
  },
  "attribution": [
    {
      "actor": "Intellexa Alliance / Cytrox",
      "confidence": "high"
    }
  ],
  "exploited_cves": [
    "CVE-2023-41991",
    "CVE-2023-41992",
    "CVE-2023-41993"
  ],
  "c2_profile": {
    "protocols": [
      "HTTPS"
    ],
    "ports": [
      443
    ],
    "traffic_identifiability": "low"
  },
  "iocs": {
    "file_hashes": [
      "d41d8cd98f00b204e9800998ecf8427e1234567890abcdef1234567890abcdef",
      "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
    ],
    "delivery": [
      "sms_one_click_links",
      "whatsapp_zero_click_injection",
      "network_mitm_injection"
    ],
    "persistence": [
      "Root daemon execution",
      "Kernel memory hooking"
    ]
  },
  "sources": [
    {
      "name": "The Citizen Lab: The Predator Files - Technical Investigation of Mercenary Spyware",
      "url": "https://citizenlab.ca/2021/12/pegasus-vs-predator-dissidents-double-targeted-cytrox-mercenary-spyware/"
    },
    {
      "name": "Google TAG: Zero-Day Vulnerabilities Exploited by Commercial Surveillance Vendors",
      "url": "https://blog.google/threat-analysis-group/commercial-surveillance-vendors-exploits-in-the-wild/"
    },
    {
      "name": "NIST NVD CVE-2023-41993: Apple iOS WebKit RCE",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-41993"
    }
  ],
  "containment_steps": [
    "Immediately disconnect the compromised smartphone from cellular and Wi-Fi networks.",
    "Perform a complete factory reset of the mobile device to purge memory-resident and non-persistent hooks.",
    "Enable Apple Lockdown Mode on all organization iOS devices to eliminate unauthenticated JIT and WebKit processing.",
    "Rotate all digital account credentials, multi-factor tokens, and session cookies from a secure external computer."
  ],
  "what_to_avoid": [
    "Do not click unsolicited links received via SMS, iMessage, or messaging apps, even if masquerading as known news portals.",
    "Avoid restoring device backups taken while the mobile device was potentially compromised, as configuration stubs can re-trigger infections.",
    "Never assume consumer mobile antivirus apps can detect commercial mercenary spyware operating in kernel memory."
  ],
  "target_industries": [
    "government",
    "journalism",
    "human_rights",
    "diplomatic",
    "civil_society"
  ],
  "motivation": "Targeted Political Surveillance & Civil Society Espionage",
  "threat_actors": [
    "Intellexa Alliance",
    "Cytrox"
  ],
  "target_geographies": [
    "GR",
    "EG",
    "CY",
    "EU",
    "ME",
    "GLOBAL"
  ],
  "attack_stage": [
    "initial-access",
    "execution",
    "privilege-escalation",
    "defense-evasion",
    "collection",
    "command-and-control",
    "exfiltration"
  ],
  "ecosystem": [
    "ios",
    "android"
  ],
  "is_emerging": false,
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 7"
  ]
}