Predator Spyware Turns Failed Attacks Into Intelligence for Future Exploits

Predator spyware is described as more sophisticated and dangerous than previously realised, with new research showing it functions as a self-diagnostic tool that learns from failed attacks to improve future versions. It was originally developed by Cytrox, which was acquired by Tal Dilian in 2018, and Intellexa now markets Predator as its best known product; it is almost exclusively aimed at national governments and intelligence agencies, and both Cytrox and Intellexa have been sanctioned by the US government.

In December 2024, Google Threat Intelligence Group published research on Predator, and Jamf has since revealed a separate sample detailing undocumented anti-analysis mechanisms, including an error code taxonomy that reports diagnostic information to the C2 infrastructure when deployment fails.

The study notes how Predator detects security tools and features such as Apple’s Developer Mode, and explains how it avoids running in the US and Israel, with the rationale tied to sanctions and deeper knowledge of those regions’ cyber operations. Jamf’s analysis also identifies an anti-forensics routine linked to crash reporting, which suppresses crash logs to thwart memory forensics, and highlights the is_corellium() stub as evidence that researchers’ tooling is being monitored.

According to Jamf, these findings underscore Predator’s adaptive capabilities and its capacity to turn failed deployments into actionable intelligence for future exploits.