Researchers have uncovered a troubling new capability being used by Predator spyware — commercial surveillance software that can secretly record audio and video on iPhones without triggering Apple’s privacy alert indicators.
Apple introduced the small green and orange dots in iOS 14 to let users know when the camera or microphone is actively in use. These visual cues are meant to help protect users from covert recording. However, the latest analysis shows Predator can bypass this safeguard, keeping its monitoring activities completely hidden.
How It Tricks iOS
Unlike generic malware, Predator doesn’t exploit a new flaw in Apple’s operating system. Instead, it takes advantage of a device that has already been fully compromised — often through zero-day vulnerabilities or highly targeted attack chains that give the spyware kernel-level access.
Once inside, Predator injects code into SpringBoard, the core iOS system process responsible for the home screen and status bar. It hooks a function that handles sensor activity updates — the very signals that tell iOS to draw the green or orange dot when the camera or microphone is activated. By intercepting this function, the spyware stops those updates before they reach the user interface, meaning no indicator ever appears even while recording is taking place.
This stealthy approach relies on an interesting quirk of Objective-C, the language used in parts of iOS: if a message is sent to a null object, nothing happens — no error, no alert, no visual cue. Predator uses this behavior to silently drop the camera/microphone activity update that Apple would normally display.
More Than Meets the Eye
Predator’s ability to suppress both green and orange dots from the status bar isn’t just a theoretical trick — it works for both camera and microphone surveillance. This means that someone operating the spyware could watch or listen through the device without the owner ever knowing.
It’s important to stress this isn’t ordinary malware found in shady links or random apps. Predator is a commercial spyware product, historically used in targeted surveillance campaigns against high-value individuals such as journalists, activists, and political figures. Getting Predator onto a device requires sophisticated techniques normally beyond the reach of casual cybercriminals.
Why This Matters
For everyday users, Apple’s camera and mic indicators remain a reliable layer of privacy protection — but only if the device hasn’t already been severely compromised. Predator’s technique shows that once an attacker has deep system control, even built-in safeguards can be neutralized.
Security experts emphasize that keeping devices updated and avoiding suspicious links or files can reduce risk. However, against advanced spyware deployed by well-resourced adversaries, defending a device requires vigilance and often professional investigation.
