Predator Spyware Silently Disables iPhone Camera and Microphone Indicators

Commercial surveillance tool hides recording alerts while streaming live feeds.

Global

Researchers have discovered that Predator, developed by Intellexa, can suppress iOS privacy indicators while secretly recording users.

The spyware disables the green and orange status bar dots that normally alert users when the camera or microphone activates.

How iOS Recording Indicators Normally Work

Since iOS 14, Apple displays:

• A green dot when the camera is active
• An orange dot when the microphone is active

These indicators appear in the status bar and serve as a user-facing privacy safeguard.

No New iOS Exploit Required

Researchers at Jamf found that Predator does not exploit a new iOS vulnerability to suppress indicators.

Instead, it relies on previously obtained kernel-level access. Once it gains deep system privileges, it modifies how sensor activity updates reach the user interface.

The HiddenDot Technique

Jamf’s analysis revealed that Predator uses a hook inside SpringBoard called HiddenDot::setupHook().

This hook intercepts sensor activity updates before they reach the display layer. Specifically, it targets a method responsible for handling camera and microphone state changes.

By nullifying the object that processes sensor updates, Predator prevents iOS from displaying any visual alert.

Because iOS ignores calls to null objects in Objective-C, the system never processes the activation event. As a result, no indicator appears.

Broader Surveillance Capabilities

Predator supports:

• Live screen streaming
• Remote camera activation
• Microphone capture
• VoIP recording

In some cases, it bypasses permission checks by leveraging ARM64 instruction pattern matching and Pointer Authentication Code (PAC) redirection.

This approach allows it to trigger camera functions without alerting users.

Why This Matters

The suppression of recording indicators removes one of the few visible protections users rely on.

Without visual cues, victims cannot distinguish between normal device behavior and active surveillance.

Although Predator typically appears in high-target espionage campaigns and has previously exploited zero-day vulnerabilities, its indicator-hiding mechanism now becomes clearer.

Forensic Detection Remains Possible

Jamf notes that technical traces can still reveal infection. Analysts may observe:

• Unusual memory mappings
• Unexpected exception ports in system processes
• Breakpoint-based hooks
• Suspicious audio file activity

However, these artifacts require advanced forensic inspection.

Strategic Implications

Commercial spyware continues to evolve toward stealth-first design. Instead of exploiting visible flaws, modern tools manipulate trusted system components to remain invisible.

As privacy indicators become standard in mobile operating systems, attackers increasingly focus on bypassing the mechanism itself.