Predator Spyware Sample Indicates 'Vendor-Controlled' C2

Researchers detailed how Intellexa, the owner of Predator, uses an elaborate set of anti-analysis features that produce data about failed deployments to strengthen its spyware and inform future attacks, according to Jamf. The analysis also shows Predator’s error-reporting can feed the C2 server, allowing operators to diagnose why an implant was detected and how to adjust deployments.

Jamf’s blog post notes that the anti-analysis capabilities suggest a centralized infrastructure or a tightly controlled deployment framework rather than purely customer-led activity, with the error-code taxonomy indicating vendor-controlled or vendor-managed infrastructure. The piece raises questions about where the error-reporting data is sent and who operates that C2, and Avraham says it could be either Intellexa directly or a broader deployment framework for customers.

The report also highlights that Predator’s design creates mechanisms for deployment visibility and troubleshooting, which defy traditional antivirus detection by emphasising a hostile environment that sophisticated malware is designed not to operate in. The investigation follows earlier research by Google and Citizen Lab into Predator, and the piece was published on 15 January 2026.