Predator’s kill switch: undocumented anti-analysis techniques in iOS spyware

Jamf Threat Labs' analysis of Predator iOS spyware uncovers undocumented anti-analysis and anti-forensics features — a detailed error-code taxonomy that reports precise deployment failures to C2, process/jailbreak/locale/console detection, kqueue-based crash-reporter monitoring that suppresses memory-forensics, SpringBoard hooking to hide recording indicators, kernel exploitation class names, and self-cleanup behaviors — demonstrating a highly sophisticated commercial spyware capability used by Intellexa operators.