Predator spyware uses new infection vector for zero-click attacks
Recorded: Dec. 5, 2025, 1:02 a.m.
| Original | Summarized |
Predator spyware uses new infection vector for zero-click attacks News Featured Critical React, Next.js flaw lets hackers execute code on servers North Korea lures engineers to rent identities in fake IT worker scheme CISA warns of Chinese "BrickStorm" malware attacks on VMware servers Marquis data breach impacts over 74 US banks, credit unions Hackers are exploiting ArrayOS AG VPN flaw to plant webshells NCSC's ‘Proactive Notifications’ warns orgs of flaws in exposed devices Predator spyware uses new infection vector for zero-click attacks Russia blocks FaceTime and Snapchat for alleged use by terrorists Tutorials Latest How to access the Dark Web using the Tor Browser How to enable Kernel-mode Hardware-enforced Stack Protection in Windows 11 How to use the Windows Registry Editor How to backup and restore the Windows Registry How to start Windows in Safe Mode How to remove a Trojan, Virus, Worm, or other Malware How to show hidden files in Windows 7 How to see hidden files in Windows Webinars Latest Qualys BrowserCheck STOPDecrypter AuroraDecrypter FilesLockerDecrypter AdwCleaner ComboFix RKill Junkware Removal Tool Deals Categories eLearning IT Certification Courses Gear + Gadgets Security VPNs Popular Best VPNs How to change IP address Access the dark web safely Best VPN for YouTube Forums Virus Removal Guides HomeNewsSecurityPredator spyware uses new infection vector for zero-click attacks Predator spyware uses new infection vector for zero-click attacks By Bill Toulas December 4, 2025 The Predator spyware from surveillance company Intellexa has been using a zero-click infection mechanism dubbed “Aladdin,” which compromised specific targets by simply viewing a malicious advertisement. Leaked Intellexa marketing materialSource: Amnesty International Overview of AladdinSource: Amnesty International Countries confirmed to host Predator activitySource: Recorded Future Break down IAM silos like Bitpanda, KnowBe4, and PathAI Related Articles: Advertisement Bill Toulas Previous Article Post a Comment Community Rules You need to login in order to post a comment You may also like: Popular Stories ChatGPT is down worldwide, conversations disappeared for users Marquis data breach impacts over 74 US banks, credit unions North Korea lures engineers to rent identities in fake IT worker scheme Sponsor Posts Empowering IT teams with intelligence driven cyber threat research. Overdue a password health-check? Audit your Active Directory for free Hackers love the holidays! Share FREE Security Awareness Training to keep family & friends cyber-safe! AI is a data-breach time bomb: Read the new report Follow us: Main Sections News Community Forums Useful Resources Welcome Guide Company About BleepingComputer Terms of Use - Privacy Policy - Ethics Statement - Affiliate Disclosure Copyright @ 2003 - 2025 Bleeping Computer® LLC - All Rights Reserved Login Username Password Remember Me Sign in anonymously Sign in with Twitter Not a member yet? Register Now Help us understand the problem. What is going on with this comment? Spam Abusive or Harmful Inappropriate content Strong language Other Read our posting guidelinese to learn what content is prohibited. Submitting... |
Predator spyware, developed by Intellexa, represents a significant escalation in the tactics employed by commercial surveillance entities. The operation, dubbed “Predator,” utilizes a novel zero-click infection vector, “Aladdin,” to compromise mobile devices, marking a shift towards more sophisticated and discreet attack methods. This spyware’s development and deployment highlight a concerning trend: the increasing availability and utilization of commercially available, highly targeted surveillance technologies. The core of the Aladdin mechanism hinges on leveraging the commercial mobile advertising system. Instead of relying on traditional click-based infection methods, Intellexa cleverly exploits Demand Side Platforms (DSPs) to deliver weaponized advertisements directly to specific individuals. These ads, appearing on any website displaying advertisements, trigger an infection upon a user’s simple viewing of the ad, without requiring any user interaction. This bypasses conventional security measures and dramatically increases the potential attack surface. The sophistication of this approach underscores a deliberate effort to minimize user awareness and resistance. A critical element of the Predator operation is its complex and dispersed infrastructure. Intellexa utilizes a network of advertising firms across multiple countries—including Ireland, Germany, Switzerland, Greece, Cyprus, the UAE, and Hungary—to obfuscate its activities and circumvent regulatory scrutiny. This multi-layered approach, combined with the seemingly innocuous nature of the attack, makes it exceedingly difficult to trace the origin of the operation or identify those directly responsible. Recorded Future’s investigation successfully mapped this network, identifying key individuals, firms, and infrastructure components, although the full extent of Intellexa’s operations remains largely concealed. Beyond Aladdin, the “Triton” delivery vector adds another layer of complexity to the Predator attack. Triton specifically targets devices with Samsung Exynos chipsets, leveraging baseband exploits to force a downgrade to 2G. This downgrade enables the installation of malware, representing a highly targeted and technically demanding strategy. The existence of Triton, along with the other suspected delivery mechanisms, “Thor” and “Oberon,” further highlights Intellexa's technical capabilities and resource investment. The fact that these vectors are potentially still active demonstrates the ongoing nature of this threat. Intellexa’s prominence in the commercial spyware market is underscored by Google’s research, which identifies the company as responsible for 15 out of 70 zero-day exploitation TAGs discovered since 2021. This positions Intellexa as a prolific operator, indicating a significant financial investment in research and development, as well as a proactive approach to identifying and exploiting vulnerabilities. The company's modus operandi includes both the development of its own exploits and the acquisition of exploit chains from external parties, illustrating a comprehensive strategy for maximizing its surveillance reach. Despite ongoing sanctions and investigations against Intellexa in Greece, the operation continues, demonstrating resilience and a continued dedication to its clandestine activities. The threat posed by Predator has prompted recommendations for enhanced user security, including enabling advanced protection features on Android and Lockdown Mode on iOS. These measures represent a basic level of defense against a highly targeted and stealthy threat, but don’t fully mitigate long-term risks. It is crucial to recognize that the intelligence gathered through Predator represents a serious risk of privacy violations and potential misuse of information, particularly by governments or intelligence agencies. The investigation reveals a troubling trend and raises serious questions regarding the ethical considerations and potential abuses associated with the widespread availability of such powerful surveillance technologies. |