Matthias Frielingsdorf of iVerify examines the 2023 evolution of Predator spyware, revealing how its redesigned architecture, infection chain and evasion tactics complicate detection on modern iOS devices.
Commercial spyware has evolved into one of the most opaque and damaging threats facing mobile ecosystems. Predator, developed by Cytrox, resurfaced in 2023 with a redesigned architecture that reduced forensic visibility while expanding operational stealth. This iteration abandons earlier tooling, introduces new execution models, and demonstrates deliberate trade-offs between persistence, evasion and detection resistance. A close examination of Predator's infection chain, loader behavior and modular design reveals how private-sector offensive tools continue to outpace traditional mobile defenses. Understanding these mechanics exposes broader gaps in mobile threat hunting and highlights why large-scale detection of advanced spyware remains elusive despite platform-level mitigations.
This video lesson, taught by Matthias Frielingsdorf, co-founder and vice president of research at iVerify, will cover:
- Architectural changes introduced in Predator's second iteration;
- Which evasion techniques target forensic visibility;
- Key differences between the 2021 and 2023 variants.
Here is the course outline:
Predator Malware: Trust Broken at the Core |
Completion
The following certificates are awarded when the course is completed:
 |
CPE Credit Certificate |
