How Predator spyware defeats iOS recording indicators

Jamf Threat Labs provides a technical analysis of Predator (Intellexa/Cytrox) iOS spyware that, after kernel-level compromise and code injection into system processes, surgically suppresses Apple’s camera and microphone recording indicators by hooking SBSensorActivityDataProvider._handleNewDomainData: (setting the Objective-C self pointer to NULL) and uses additional modules (CameraEnabler, VoIP recorder) with ARM64 pattern matching and PAC redirection; the report includes IOCs, dead-code findings, and detection recommendations for defenders.