PredatorMalware
- preyhunter
Commercial spyware by Intellexa.From MISP Galaxy
Last reported 28 days ago, by CERT-EU4 reports
ATT&CK techniques
4 techniques · each with the sentence it comes from- T1684Social Engineering
“This method significantly reduces the risk of detection and failure, as it does not rely on preemptive social engineering.”
- T1195Supply Chain Compromise
“We noted several global China-linked campaigns, such as APT group Lotus Blossom's Notepad++ supply-chain compromise and UNC2814’s campaign targeting telecoms and government entities worldwide.”
- T1552.004Private Keys
“…t 341 malicious “skills” published to ClawHub and GitHub that deliver info-stealing malware targeting cryptocurrency API keys, wallet private keys, SSH credentials and browser passwords.”
- T1657Financial Theft
“…ack spoofed Ukrainian judicial domains to target a senior legal advisor, aiming to gain remote access for intelligence gathering or financial theft.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
4 reports, newest first · the exact sentence from each-
Cyber Brief 26-03 - February 2026“Greek court convicts Intellexa executives in Predator spyware wiretapping scandal”
-
ADINT: From Ad-Based Geolocation Tracking to Intrusion Vector“…019 marketing materials associated with the CSV Candiru as the provider of Sherlock, an AdTech-based delivery vector used to deploy the Predator spyware, an early documented instance of offensive ADINT.”
-
Predators for Hire: Commercial Surveillance Vendors Overview“…) using exploits that are extremely similar to those previously used by commercial surveillance vendors (CSV), particularly Intellexa’s Predator spyware.”
-
In-Depth Analysis of Pegasus Spyware and How To Detect It on Your Mobile Devices“The suggested methodology can be leveraged to detect not just Pegasus spyware but also Operation Triangulation, Predator spyware, and more.”
Indicators in its reports
named in the reports above- gov[.]ukin 1 report
- surveillancewatch[.]ioin 1 report
- yahoo[.]frin 1 report
- hxxp://yahoo[.]fr/in 1 report
- 1a0e7afc19d307da…af33afe92c53in 1 report
- 7ad4e8732baf100a…70fded6cfe91in 1 report
- hxxps://m.ais.co[.]th/J1Hpm91ixin 1 report
- m.ais.co[.]thin 1 report
- sitecdn[.]comin 1 report
Copy these 9 indicators · defanged
Thanks — we review every report.