Apple's camera and microphone indicators are a cornerstone of iPhone privacy, but security researchers at Jamf have discovered that Predator spyware can suppress these visual cues. The spyware achieves this by injecting code into SpringBoard, the system process that manages the status bar and home screen.

This technique requires kernel-level access and represents post-compromise behavior rather than a new iOS vulnerability. Predator intercepts sensor activity updates before they reach the user interface, allowing the camera or microphone to operate without triggering the familiar green or orange dot. The phone continues to function normally, giving users no obvious reason to suspect surveillance.

Since iOS 14, these recording indicators have been designed to prevent apps from hiding sensor access, with iOS sending notifications to SpringBoard when recording begins. Predator hooks a single SpringBoard method used to handle sensor activity changes, causing the message to be discarded. This sophisticated approach puts the threat in the category of commercial spyware rather than everyday malware, requiring deep system compromise that most users are unlikely to encounter.