Leaks show Intellexa burning zero-days to keep Predator spyware running

Leaks show Intellexa burning zero-days to keep Predator spyware running, with independent investigations describing the company as still active and hitting new targets despite sanctions and investigations in Greece.

According to Google’s Threat Analysis Group (TAG) blog, the iOS zero-day exploit chain developed by Intellexa was used in the wild against targets in Egypt to surreptitiously install Predator, and the researchers note Intellexa’s practice of buying and using zero-days until patches appear, effectively “burning” them.

The piece also notes that the price for a robust, weaponised remote code execution exploit against Chrome can range from $100,000 to $300,000, while Zerodium reportedly offered millions in 2019 for certain Android and iPhone zero-click chains. Intellexa purportedly delivers one-time links via end-to-end encrypted messaging apps and uses malicious ads to fingerprint visitors, a zero-click infection chain referred to as Aladdin that remains believed to be operational. Amnesty International researchers reviewed leaked materials to verify the evidence, illustrating the ongoing risks posed by commercial spyware.