Skip to content
844-974-8669 Ask Zeus Book a call

Intelligence briefFall/Winter 2026/2027 Edition

Intellexa's Aladdin ad vector is unconfirmed as spyware vendors lead zero-days

Google ties more 2025 zero-day exploitation to commercial spyware vendors than to state hackers, while Intellexa's Aladdin ad vector is documented but unconfirmed in the wild. Patch phones fast and harden browsers.

Download the PDF, 808 KB Talk to the SOC
Part 2 of 2 · Intellexa

At a glance

SP-02 · Spyware vendor

  • 15 of about 70 zero-days Google's Threat Analysis Group discovered and documented since 2021 that it attributes to Intellexa[3]
  • 90 zero-days exploited in 2025, with commercial vendors ahead of state groups for the first time[4]
  • 27 states that have signed the Pall Mall Code of Practice, per the UK NCSC[27]
  • 561 spyware-market entities in 46 countries, per the Atlantic Council[29]
Status
Ongoing risk. Recorded Future still sees Predator customers in Saudi Arabia, Kazakhstan, Angola and Mongolia and Google counts commercial vendors ahead of state hackers in 2025 zero-day use, but no source confirms Aladdin ad delivery by name in the wild.[1]
Aladdin design
Forces a targeted ad onto a phone, aimed by public IP address or ad identifier; Amnesty says viewing the ad is enough to infect[2]
Evidence of use
Recorded Future knew of no in-the-wild Aladdin use on December 3, 2025; Google saw malicious ads redirect targets for a few Predator customers since early 2025[1]
Main delivery route
One-time links sent over encrypted messaging apps; ad-based delivery appeared with only a few customers[3]
Zero-day share
Google counted 90 zero-days exploited in 2025, 15 on mobile, and for the first time tied more to commercial surveillance vendors than to state espionage groups[4]
Active customers
Saudi Arabia, Kazakhstan, Angola and Mongolia still observed in late 2025, with new evidence for Iraq; Egypt, Trinidad and Tobago and Botswana went quiet between March and June 2025[1]
US controls
Four Intellexa Entity List entries and ten Intellexa SDN listings (four individuals, six entities) remain; NSO Group and Candiru stay on the Entity List[14]

What happened

Part 1 of this series covers Intellexa's sanctions, the Greek convictions and the December 2025 leaks. This part asks what the evidence shows about the ad-based Aladdin vector and how the wider spyware market and the policy response have moved since the original edition. The short answer is that Aladdin is well documented as a design but thinly confirmed as an attack, while the vendors' lead in zero-day use and the policy gaps are both measurable.

  • Amnesty Security Lab's analysis of the leaked files describes Aladdin as forcing a malicious ad onto a target's phone on any ad-serving site, with simply viewing the ad enough to infect, aimed by public IP address and possibly with help from a domestic mobile operator; Amnesty believes it supported active deployments in 2024.
  • Recorded Future, publishing the day before, says Haaretz first reported Aladdin in April 2024 from 2022 documents as a proof of concept, and that it knows of no reporting that Aladdin has been used in the wild. It also says no confirmed Predator case matches the fully remote zero-click exploits seen with Pegasus.
  • Google's December 3, 2025 analysis says one-time links over encrypted messengers remain Predator's primary delivery route, but for a few customers it saw malicious ads on third-party platforms fingerprint users and redirect targets to Intellexa exploit servers, with Intellexa increasingly involved since early 2025. Google does not use the name Aladdin or name the companies whose accounts partners shut down.
  • Google's March 5, 2026 review counted 90 zero-days exploited in 2025, 15 of them on mobile operating systems against 9 in 2024, and attributed more of them to commercial surveillance vendors than to state-sponsored espionage groups for the first time. It calls Intellexa a prolific procurer that adapted its operations.
  • Policy moved unevenly: Treasury delisted three Intellexa enablers in December 2025 (covered in Part 1), ICE's Paragon contract was reactivated in 2025 and closed out in January, and the Pall Mall Process industry guidelines are expected in November 2026.
  • The Atlantic Council's September 2025 mapping counts 561 spyware-market entities in 46 countries, 43 of them founded in 2024, with US-based investors up from 11 to 31.

How it works

The attack as a living map, in kill-chain order from the first foothold to impact. Point at a step to light its wiring, click to pin its story.

at risk
  • entry
  • next step
  • impact

Read the attack chain

The threat on the left, each step in order, the people at risk on the right: point at a step to light its wiring, click to pin its story here.
00the attack chain
  • entry
  • next step
  • impact

Tap a node to read its story.

Step by step

  1. Pick the target by IP or ad ID

    Leaked Aladdin documentation says the system was designed around the target's public IP address, with other selectors such as an advertising ID, and that an operator can ask a domestic mobile operator for the IP. The ad is then bought to reach that device.

  2. Buy the ad through ad-tech fronts

    Recorded Future found two ad-sector companies, Pulse Advertise and MorningStar TEC, hosted on one IP address and linked to the Czech cluster, that it assesses may be involved in Aladdin. Google says partners shut down accounts of companies Intellexa created but names none.

  3. Fingerprint and redirect on render

    Google saw malicious ads on third-party platforms used to fingerprint users and redirect targeted ones to Intellexa's exploit delivery servers. Amnesty says viewing the ad is enough to trigger the infection, while Recorded Future's account of the 2022 proof of concept has bait ads that the target interacts with.

  4. Run a browser exploit chain

    A browser remote code execution bug is paired with a sandbox escape and privilege escalation. Google's 2025 examples are CVE-2025-6554 in Chrome's V8 engine and CVE-2025-48543 in the Android Runtime.

  5. Install an implant that hides itself

    Jamf's analysis of a Predator iOS sample found a SpringBoard hook that suppresses the green camera and orange microphone indicators. Jamf says this is post-compromise behavior, not a new iOS vulnerability.

  6. Hide the customer behind tiers

    Recorded Future describes servers that relay through up to five tiers, a push to hide behind Cloudflare and domain names harder to tie to a region. It saw less Predator infrastructure in 2025 than in 2024.

Who is at risk

Recorded Future says Predator's costly licensing makes operators likely to reserve it for high-value targets, and that executives and other high-profile people are increasingly targeted. The Treasury said Predator was used to target Americans, including US government officials, journalists and policy experts.

  • Executives, counsel and deal teams who travel to or negotiate with parties in countries where Recorded Future assesses active customers: Saudi Arabia, Kazakhstan, Angola and Mongolia, with new evidence for Iraq.
  • Journalists, human rights defenders and opposition figures in confirmed-use cases such as Angola, where the victim's iPhone ran iOS 16.2, and people in or connected to Pakistan's Balochistan region.
  • Anyone whose phone renders web ads, if Aladdin works as designed, because the exposed group is set by the ad path rather than by a lure; the design is documented but its use is unconfirmed.
  • Organizations with telecom, hosting or technology suppliers in Predator-active countries, since Amnesty says Mars and Jupiter injection needs operator cooperation and Aladdin targeting can draw on operator-supplied IP data.
  • Compliance teams that screen only for the name Predator, since Amnesty confirms the product is also marketed as Helios, Nova, Green Arrow and Red Arrow.

Sectors in scope

  • Journalists and press freedom organizations
  • Opposition politicians and parliamentarians
  • Human rights defenders and lawyers
  • Government officials
  • Business leaders and other high-value private-sector targets
04What changed

What changed since the last edition

Fall/Winter 2026/2027 Edition8 changes

  1. Google's March 5, 2026 zero-day review attributed more 2025 exploitation to commercial surveillance vendors than to state-sponsored espionage groups for the first time, counted 90 zero-days overall and 15 on mobile operating systems, and singled out Intellexa as a prolific procurer that adapted its operations.

    Source 4

  2. Correction: the original edition presented Aladdin as an operational zero-click vector that became operational in 2024. Amnesty believes it supported active deployments in 2024, Google saw ad-based redirection with a few customers, and Recorded Future knew of no in-the-wild Aladdin use as of December 3, 2025; the 2026 items checked (Google's March review, Amnesty's Security Lab listing) do not address Aladdin.

    Source 1

  3. Recorded Future's report, updated February 20, 2026, ties Pulse Advertise and MorningStar TEC, both hosted on IP address 173[.]236[.]243[.]198, to the Czech cluster and says they may be connected to Aladdin. It cites a July 28, 2022 invoice for 'project POC Aladin' to a Czech-cluster company, reported by Vsquare in August 2025, and finds less Predator infrastructure in 2025 than in 2024.

    Source 1

  4. NPR reported on May 22, 2026 that ICE reactivated its Paragon Solutions contract in August 2025 and that a procurement notice shows it closed out on January 20; DHS said ICE has no relationship with Paragon or its acquirer and would not say whether ICE keeps access through a third party. The acting ICE director's April 1, 2026 letter acknowledged approving a commercial spyware tool without naming it.

    Source 23

  5. WhatsApp's parent announced a contempt motion against NSO Group on June 8, 2026, alleging test accounts and fresh one-click lures after the permanent injunction; NSO's appeal is pending at the Ninth Circuit. Rep. Summer Lee asked Commerce on May 7, 2026 for its records on the US purchase of NSO.

    Source 19

  6. Paragon's CEO told WIRED in October 2026 that the company has no way to know whether customers misuse its software and has no kill switch to disable them.

    Source 24

  7. Amnesty and civil society partners said on July 6, 2026, after Citizen Lab found Pegasus on a former member of the European Parliament who sat on its spyware committee, that nearly three years after the PEGA report the EU has not delivered a meaningful EU-wide response, and asked the Commission for a public roadmap.

    Source 25

  8. The Pall Mall Process industry guidelines for commercial cyber intrusion capabilities are expected to be finalized in November 2026, according to a September 17, 2026 joint civil society submission, with the UK NCSC counting 27 states that have signed the Code of Practice for States.

    Source 28

What to do now

In priority order, highest impact first.

  1. Do firstEnforce current iOS, Android and browser updates through MDM within days of release, and deny corporate access from devices below the current version.

    Every Intellexa zero-day Google lists has a vendor patch, and the Angolan victim's iPhone was on iOS 16.2 when it was infected.

  2. Turn on Lockdown Mode on iPhones, and the equivalent hardened mode on Android where offered, for executives, counsel, board members and frequent travelers.

    Recorded Future lists Lockdown Mode among its mitigations against Predator.

  3. Block ads and third-party trackers in managed mobile browsers and restrict ad-tracking identifiers on corporate devices.

    Google saw malicious ads redirect targets to exploit servers and Recorded Future recommends ad blocking and limiting ad identifiers, so the ad path is a plausible infection path that link training does not cover.

  4. Add mobile telemetry for camera or microphone use without an on-screen indicator, unexpected memory mappings in SpringBoard or mediaserverd, and processes impersonating system names under /private/var/containers/Bundle/.

    These are the behaviors Jamf and Amnesty documented in Predator samples.

  5. Write a mobile compromise playbook: isolate the device, capture an iOS backup or Android bug report before any reboot, notify counsel, and treat an Apple or Google threat notification as an incident.

    The Angolan infection ended when the phone restarted, which removed most of the evidence.

  6. Extend third-party risk reviews to telecom, hosting and technology suppliers in countries where Recorded Future assesses active Predator customers, and ask about lawful-intercept and operator cooperation duties.

    Amnesty says Mars and Jupiter injection depends on operator cooperation and Aladdin targeting can use operator-supplied IP data.

  7. Screen counterparties against the SDN and Entity lists for Intellexa S.A., Intellexa Limited, Cytrox AD, Cytrox Holdings, Thalestris, Aliada Group and the names Helios, Nova, Green Arrow and Red Arrow, and track delistings as closely as designations.

    Three enablers were delisted on December 30, 2025 while the entities stayed listed, so a stale list is wrong in both directions.

  8. Put commercial spyware on the board risk register with a named owner; Z7's 24/7 SOC and Microsoft 365 posture review can supply the identity and mobile telemetry behind it.

    Google now counts commercial vendors ahead of state espionage groups in 2025 zero-day use, so the risk is no longer niche.

Indicators

Indicators the sources publish, shown as they print them. Use them to hunt and to enrich alerts, and check the source before you block.

Indicators published by the sources
TypeIndicatorSource
domain pulseadvertise[.]com (ad-sector company Recorded Future assesses as potentially involved in Aladdin; treat as a hunting lead, not proof) [1]
domain morningstartec[.]com (ad-sector company Recorded Future assesses as possibly involved in Aladdin; treat as a hunting lead, not proof) [1]
ip 173[.]236[.]243[.]198 (hosted both domains above, per Recorded Future) [1]
domain badinigroup[.]com (Recorded Future, Predator customer assessed in Iraq) [1]
domain birura[.]com (Recorded Future, Predator customer assessed in Iraq) [1]
domain gardalul[.]com (Recorded Future, Predator customer assessed in Iraq) [1]
domain keep-badinigroups[.]com (Recorded Future, Predator customer assessed in Iraq) [1]
ip 5[.]253[.]43[.]92 (Recorded Future Appendix A) [1]
ip 38[.]180[.]54[.]77 (Recorded Future Appendix A) [1]
ip 45[.]86[.]231[.]8 (Recorded Future Appendix A) [1]
ip 89[.]150[.]57[.]85 (Recorded Future Appendix A) [1]
behavior SpringBoard receiving sensor activity notifications without updating the UI, and unexpected memory mappings in SpringBoard or mediaserverd [6]

Sources

Every number and claim in this brief traces to a source below. Each source opens in a new tab at the publisher.

  1. [1]
    Intellexa's Global Corporate Web (CTA-2025-1203) (opens in a new tab) Recorded Future Insikt Group · December 3, 2025 (updated February 20, 2026 with a minor correction) · assets.recordedfuture.com
  2. [2]
    To Catch a Predator: Leak exposes the internal operations of Intellexa's mercenary spyware (opens in a new tab) Amnesty International Security Lab · December 4, 2025 · securitylab.amnesty.org
  3. [3]
    Sanctioned but Still Spying: Intellexa's Prolific Zero-Day Exploits Continue (opens in a new tab) Google Threat Intelligence Group · December 3, 2025 · cloud.google.com
  4. [4]
    2025 zero-day exploitation review (Look What You Made Us Patch) (opens in a new tab) Google Threat Intelligence Group · March 5, 2026 · cloud.google.com
  5. [5]
  6. [6]
    How Predator spyware defeats iOS recording indicators (opens in a new tab) Jamf Threat Labs · February 19, 2026 · jamf.com
  7. [7]
    Journalism under attack: Predator spyware in Angola (opens in a new tab) Amnesty International Security Lab · February 18, 2026 · securitylab.amnesty.org
  8. [8]
    Predator still active, new links identified (opens in a new tab) Recorded Future Insikt Group · 2025 (report cta-2025-0612; page shows no date) · recordedfuture.com
  9. [9]
    Tracking Candiru's DevilsTongue Spyware in Multiple Countries (opens in a new tab) Recorded Future Insikt Group · 2025 (analysis cutoff June 26, 2025) · recordedfuture.com
  10. [10]
  11. [11]
    Treasury Sanctions Members of the Intellexa Commercial Spyware Consortium (opens in a new tab) US Department of the Treasury · March 5, 2024 · home.treasury.gov
  12. [12]
    Cyber-related Designations (Intellexa enablers) (opens in a new tab) US Treasury, Office of Foreign Assets Control · September 16, 2024 · ofac.treasury.gov
  13. [13]
    Non Proliferation and Iran-related Designations; Cyber-related and Russia-related Designations Removals (opens in a new tab) US Treasury, Office of Foreign Assets Control · December 30, 2025 · ofac.treasury.gov
  14. [14]
    Consolidated Screening List (CSV download, checked for Intellexa, Cytrox, NSO and Candiru entries) (opens in a new tab) US International Trade Administration · retrieved October 13, 2026 · data.trade.gov
  15. [15]
    US imposes visa restrictions on 13 individuals tied to commercial spyware (headline paraphrased) (opens in a new tab) The Hacker News, reporting a State Department announcement · April 23, 2024 · thehackernews.com
  16. [16]
    Letter to Secretaries Bessent and Rubio regarding commercial spyware sanctions delistings (opens in a new tab) US Senators Warren, Shaheen, Kim, Schiff and Bennet · February 13, 2026 · bennet.senate.gov
  17. [17]
  18. [18]
  19. [19]
  20. [20]
  21. [21]
  22. [22]
    Former Trump official named NSO Group executive chairman (opens in a new tab) The Record · November 10, 2025 · therecord.media
  23. [23]
  24. [24]
    The Secrets of a US Spyware King (opens in a new tab) Citizen Lab, reporting WIRED · October 8, 2026 · citizenlab.ca
  25. [25]
    Joint Statement: Pegasus in the parliament, the EU must act now (opens in a new tab) Amnesty International Security Lab · July 6, 2026 · securitylab.amnesty.org
  26. [26]
    Pall Mall Process Code of Practice for States (opens in a new tab) UK Government (Foreign, Commonwealth and Development Office) · April 4, 2025 (updated October 23, 2025) · gov.uk
  27. [27]
  28. [28]
    Essential Elements for Ensuring the Industry Guidelines for Commercial Cyber Intrusion Capabilities Deliver on their Potential (opens in a new tab) Joint civil society submission hosted by Freedom House · September 17, 2026 · freedomhouse.org
  29. [29]
  30. [30]
  31. [31]
  32. [32]
    Order Granting Plaintiffs' Motion for Permanent Injunction (Dkt. 809), WhatsApp LLC v. NSO Group Technologies Ltd., No. 4:19-cv-07123 (opens in a new tab) US District Court, Northern District of California · November 12, 2025 · storage.courtlistener.com

The series: Intellexa

2 parts

  1. Part 1 of 2 · read firstPredator persists as Greece convicts four
  2. Part 2 of 2 · you are readingSpyware vendors lead zero-days; Aladdin unconfirmed

Z7 Weekly Intelligence

We aim for one email a week: the threats that matter, new Z7 intelligence briefs and articles, and what to do about them. Unsubscribe anytime.

By subscribing, you agree to our Terms of Use. Our Privacy Policy explains how we use your email.

All Z7 Cyber Intelligence briefs
  • SP-03Spyware vendor ongoing risk

    Spyware vendors outlast sanctions and verdicts

    TakeawayPatch fast; treat Apple alerts as incidents.

    • 90 zero-days exploited in the wild in 2025
    • 110 countries in Apple's August 2026 spyware alert wave
    • Commercial spyware industry
    • Spyware vendor
    • Government officials and legislators
    PDF785 KB
  • IS-01Infostealer active

    Odyssey Stealer now leads macOS stealers

    TakeawayBlock Terminal paste lures, patch macOS and revoke sessions fast.

    • 62.7% of macOS stealer detections, first half of 2026
    • 100+ countries with infections, per Moonlock in July 2026
    • Odyssey Stealer
    • Infostealer
    • Technology and software development
    PDF821 KB
  • BA-01Breach analysis ongoing risk

    SitusAMC breach settlement and vendor risk

    TakeawayTier vendors by the data they hold.

    • 662,792 people on the settlement class list
    • $5.3M proposed class settlement fund
    • SitusAMC
    • Breach analysis
    • Banking and mortgage lending
    PDF728 KB

What does this mean for your security?

Bring your questions about exposure, defenses and cost. Talk with our team about what applies to your environment and where to start.

Book a security conversationAsk Zeus Call 844-974-8669
Ask Zeus AI assistant