Spy vs. Spy: Predator Malware Now Hunts the Researchers

Jamf Threat Labs' analysis reveals that Intellexa's Predator spyware contains sophisticated anti-analysis and self-preservation features—including a CSWatcherSpawner module that detects developer modes, jailbreaks, and network interception; a detailed error-code taxonomy (301–311) giving operators granular failure diagnostics; stubs to detect Corellium; capabilities to hide iOS recording indicators; and crash-report scrubbing—complicating forensic analysis and enabling operators to adapt and refine attacks.