Spyware Vendor Intellexa Used 15 Zero-Days Since 2021, Deploying Predator via “smack” iOS Exploit Chain

According to Google Threat Intelligence Group (GTIG), the mercenary spyware vendor Intellexa has built a record of exploiting zero‑days since 2021, with about 70 zero‑day vulnerabilities tracked in the wild and 15 of them attributed specifically to Intellexa, including Remote Code Execution, Sandbox Escape, and Local Privilege Escalation flaws.

The report details an iOS exploit chain, internally named by Intellexa as “smack,” used against targets in Egypt to install the Predator spyware, leveraging a framework Google calls “JSKit” to execute native code on Apple devices. Once a device is compromised, the payload PREYHUNTER is deployed, with helper and watcher modules to keep the implant hidden while conducting surveillance tasks such as recording VOIP calls, keylogging, and capturing photos.

Intellexa has also deployed frameworks to exploit Chrome’s V8 engine, and in June 2025 were observed exploiting CVE-2025-6554 in Saudi Arabia to leak memory objects. The analysis notes that Intellexa likely did not build the JSKit framework themselves and suggests they acquired the iOS RCE exploits from an external entity, while warning of their shift into malicious advertising to fingerprint users and direct them to Intellexa’s exploit delivery servers.