Predator spyware bypasses iPhone privacy indicators without user notification
Security researchers at Jamf discovered that Predator spyware can disable iPhone camera and microphone privacy indicators, allowing covert surveillance. The technique requires full device compromise and kernel access, using hooks and code injection to suppress the green and orange indicator dots that normally signal camera and microphone activity.
What happened
The security research team at Jamf discovered that Predator spyware, a commercial product from Intellexa/Cytrox, can disable iPhone camera and microphone privacy indicators. The spyware accomplishes this by using hooks and code injections to manipulate system processes, suppressing the green dot that indicates camera access and the orange dot that signals microphone use.
For the technique to work, the iPhone must be fully compromised and the spyware must have kernel access. Unlike earlier spyware that simulated device shutdown before activating camera and microphone, Predator allows the iPhone to operate normally while suppressing the privacy indicators in the background.
Reported impact
The capability enables covert surveillance through camera and microphone access while preventing users from becoming aware through the normally reliable privacy indicators. iPhones lack physical LEDs like those on Mac computers, relying instead on graphical indicators on the screen.
Index analysis
The Jamf study performed reverse-engineering of Predator and identified a single hook capable of disabling both camera and microphone indicators. The research does not identify new attack vectors for current iOS versions and does not clarify whether Apple can prevent this type of attack or whether the exploited vulnerabilities can be patched.
Predator is known to be expensive and used only for targeted attacks. Google Threat Intelligence Group had previously reported on Predator attacks in 2024.
Governance controls
The Jamf research reveals sophisticated post-exploitation techniques used by commercial spyware to bypass iOS privacy protections, filling gaps in existing threat intelligence.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.