Spy vs. Spy: Predator Malware Now Hunts the Researchers

In a 20 January 2026 report by Jamf Threat Labs, researchers uncovered anti‑analysis mechanisms within Intellexa’s Predator spyware, revealing a level of self‑preservation that turns the tables on defenders. The analysis highlights a C++ class named CSWatcherSpawner that orchestrates a suite of detection methods, with Predator performing a comprehensive environmental scan rather than simply terminating in a sandbox.

It details checks for developer modes, jailbreaks, and network interception, and provides a complete taxonomy of error codes 301 to 311 that act as precise diagnostic tools for why an infection failed. “The error code taxonomy demonstrates that Intellexa operators have granular visibility into why deployments fail, enabling them to adapt their approaches for specific targets,” the report claims.

The findings also show Predator can manipulate the user experience by hooking into the iOS SpringBoard to hide recording indicators, keeping the victim unaware that their microphone or camera is active. A stubbed is_corellium() function—detecting Corellium, a cloud‑based iOS virtualization platform used by the security research community—was present, though not active in the sample.

According to Jamf Threat Labs, this indicates commercial spyware vendors are actively engineering tools to detect and bypass environments used by professional malware analysts.