Intellexa Exploits Zero-Day Vulnerabilities with Spyware

Despite significant geopolitical challenges, the mercenary spyware industry remains a resilient and persistent threat; in this context, the well-known vendor Intellexa continues to expand its arsenal.

A recent report from the Google Threat Intelligence Group (GTIG) highlights how the company, famous for its “Predator” spyware, is not only resisting US sanctions , but is also actively circumventing restrictions to continue to thrive , by exploiting a steady stream of zero-day vulnerabilities.

Intellexa has built a formidable reputation in the surveillance market. According to a Google analysis , the vendor has “solidified its position as one of the most prolific, if not the most prolific, spyware vendors in exploiting zero-day vulnerabilities against mobile browsers.”

The scale of their operations is impressive. Since 2021, Google has tracked approximately 70 zero-day vulnerabilities in use. Of these, “Intellexa is responsible for 15 unique zero-day vulnerabilities, including Remote Code Execution (RCE), Sandbox Escape (SBX), and Local Privilege Escalation (LPE).”

The report details a sophisticated iOS exploit chain, internally referred to by Intellexa as “smack,” that was used against targets in Egypt to install Predator spyware.

This chain was based on a framework Google calls “JSKit.” This modular toolkit is designed to run native code on Apple devices by parsing Mach-O binaries directly in memory. Interestingly, Google researchers believe Intellexa likely didn’t develop it independently.

“We believe Intellexa acquired its iOS RCE exploits from an external entity, as we have seen this exact same JSKit framework used by other surveillance vendors and government-backed attackers since 2021,” the report states.

Once the device is compromised, a payload labeled PREYHUNTER is deployed. This stage consists of “helper” and “watcher” modules that ensure the implant remains hidden while performing surveillance activities. Using custom hooking frameworks (” DMHooker” and “UMHooker” ), the malware can record VOIP calls, run keyloggers, and capture photos.

Intellexa’s reach extends beyond iPhones. The group has also implemented custom frameworks to exploit Chrome, specifically targeting the V8 JavaScript engine. More recently, in June 2025, they were observed exploiting CVE-2025-6554 in Saudi Arabia, a type confusion flaw that allowed them to infringe on memory objects.

In response to these findings, Google is taking direct action to alert potential victims. “We have decided to simultaneously send our government-backed attack warning to all known targeted accounts associated with Intellexa customers since 2023,” the report states.

This mass notification affects hundreds of users in Pakistan, Kazakhstan, Angola, Egypt, Uzbekistan, Saudi Arabia, and Tajikistan, signaling a sharp escalation in the tech giant’s fight against the spyware trade.

Follow us on Google News to receive daily updates on cybersecurity. Contact us if you would like to report news, insights or content for publication.

Redazione

The editorial staff of Red Hot Cyber is composed of IT and cybersecurity professionals, supported by a network of qualified sources who also operate confidentially. The team works daily to analyze, verify, and publish news, insights, and reports on cybersecurity, technology, and digital threats, with a particular focus on the accuracy of information and the protection of sources. The information published is derived from direct research, field experience, and exclusive contributions from national and international operational contexts.