Intellexa Leaks Reveal Zero-Days and Ads-Based Vector for Predator Spyware Delivery

Intellexa leaks detail zero-days and an ads-based delivery vector for Predator spyware, with the report noting that initial access can be gained by a malicious link that loads a browser exploit on Android Chrome or iOS Safari. The data from GTIG lists multiple CVEs linked to exploitation, including CVE-2025-48543, CVE-2025-6554, CVE-2023-41993, CVE-2023-41992, CVE-2023-41991, CVE-2024-4610, and others, some used in iOS and Android components.

The findings describe a two-stage infection chain, with PREYHUNTER modules Watcher and Helper deployed after Safari sandbox breakout, and note that Intellexa markets Predator under other names such as Helios, Nova, Green Arrow, and Red Arrow. According to Google, the JSKit framework enables in-memory mapping and execution of Mach-O binaries, and the report highlights a shift to leveraging malicious ads via the Aladdin vector to trigger infections without user interaction.

Amnesty International and Recorded Future are cited for concerns about potential human rights impacts and the breadth of Predator activity, including indications of customers in multiple countries still communicating with Predator infrastructure.