iPhone spyware bypasses iOS protection for camera & audio

For years, the iPhone has stood for a high level of security and privacy. With each iOS version, new protective mechanisms have been introduced to prevent unauthorized access to the camera and microphone. However, a recent report shows that even these measures can be circumvented. A known iOS spyware program is capable of selectively suppressing the iPhone's recording indicators, thus enabling covert surveillance.

Since iOS 14, iPhones have used colored dots in the status bar to indicate when the camera or microphone is active. This feature is considered an important security measure because it provides transparency. However, this very transparency is now being undermined by sophisticated spyware. This case demonstrates just how professional and technically advanced modern surveillance software has become.

New findings from security research

Researchers at Jamf Threat Labs have analyzed iOS spyware specifically designed to disable the iPhone's camera and microphone indicators. This prevents the green and orange dots in the status bar from appearing, even when the camera or microphone is actively in use. In this state, the iPhone can record audio or video without the user's knowledge.

What's behind the Predator spyware

The discovered spyware is called Predator and was developed by the company Intellexa. Intellexa is a commercial spyware consortium that primarily sells its products to governments and large organizations. Predator has existed for several years and is not a new development.

In its functionality, Predator is very similar to the well-known spyware Pegasus, which has been used in the past to spy on journalists, activists, and political figures. Predator can also access sensitive iPhone functions, including the camera and microphone, record data, and transmit this information to the attacker.

Bypassing iOS security indicators

With iOS 14, Apple introduced visible warning notifications:

A green dot indicates that the camera or camera and microphone are active.

An orange dot indicates that the microphone is being used alone.

These indicators typically appear even when an app is accessing these functions in the background. However, Jamf's report shows that Predator can selectively suppress these indicators. This renders a key iOS security feature ineffective, and the iPhone gives the impression that no recording is taking place, when in fact it is.

Route of infection and area of operation

To infect an iPhone with Predator, interaction is required. In practice, this usually happens via a link sent to the recipient via message. After clicking the link, the spyware can be installed without any immediately noticeable indications.

Predator is not used on a widespread basis. The spyware is designed for targeted surveillance and is primarily used in the context of government or corporate espionage. Mass deployment against ordinary iPhone users is not known, but is considered technically possible.

Protective measures for the iPhone

Even though the likelihood of encountering Predator is low, basic security rules remain important. Links from unknown or suspicious senders continue to pose a significant risk and should generally not be opened.

Regular iOS updates are equally crucial. Security updates close known vulnerabilities and reduce the risk of spyware successfully being used on the iPhone. Updates can be installed via "Settings," "General," and "Software Update.".

Why even the iPhone is not unassailable

The Predator case demonstrates that even advanced iPhone security mechanisms can be circumvented using sophisticated spyware. While this type of surveillance is targeted and not widespread, it underscores the continued importance of caution and up-to-date software. The iPhone still offers a high level of security, but absolute security is impossible. (Image: Shutterstock / Fah Studio 27)