jiska 🦄

Jamf analyzed an iOS Predator implant that disables rendering of the green and orange dots to hide microphone & camera recording by the spyware. It hooks methods inside SpringBoard and mediaserverd. Apple abandoned mediaserverd in iOS 18, and simple user-space hooking shouldn't work on any modern iPhone due to Exclaves. But Forbes now relates that research to iOS 26.2 and 26.3 updates 🤔🤦‍♀️

https://www.jamf.com/blog/predator-spyware-ios-recording-indicator-bypass-analysis/
https://www.forbes.com/sites/kateoflahertyuk/2026/02/20/how-apple-iphone-spyware-can-bypass--orange-and-green-dot-indicators/

How Predator Spyware Defeats iOS Recording Indicators

An analysis documenting how a commercial spyware sample, Predator, operates post-compromise.

Feb 22 at 1:17pmWeb
Show threadhttp Feb 22
@jiska They don't exactly say it's related in the article, but yes, it sounds like that. Also, the jamf article doesn't really mention the affected iOS versions, so for a non-technical user, it's not clear. And even tech users don't all know these details.
But good point you're making here. They should've gotten a proof reader that is not an LLM.