Sanctioned but Still Spying Intellexa’s Prolific Zero-Day Ex...

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://cloud.google.com/blog/topics/threat-intelligence/intellexa-zero-day-exploits-continue
• Blog Title: Sanctioned but Still Spying: Intellexa’s Prolific Zero-Day Exploits Continue
• Suggested Section: Binary Exploitation -> Chrome Exploiting (for the TheHole-based V8 framework) and iOS Exploiting (for JSKit, iOS chain pattern, kernel UAF + code-signing bypass); also cross-linked from Mobile Pentesting -> iOS Pentesting and Generic Methodologies & Resources -> Basic Forensic/ Malware Analysis (for anti-analysis, staging, and YARA-based hunting patterns).

🎯 Content Summary

This blog analyzes Intellexa’s continued use of high-end, mobile-focused zero-day exploit chains, detailing the technical roles of at least 15 CVEs across iOS, Android, Chrome, Skia, and ARM Mali, the structure of an iOS chain internally called “smack”, and the PREYHUNTER iOS post-exploitation stager, plus hunting artifacts including a YARA rule.

Zero-day portfolio and bug classes
Google Threat Intelligence Group (GTIG, formerly TAG) attributes 15 distinct ze...

🔧 Technical Details

Reusable iOS exploitation via JSKit and memory corruption in WebKit
The core trick is to treat WebKit JIT bugs (e.g., CVE-2023-41993) simply as a source of arbitrary memory R/W in the Safari renderer and offload all exploit logic to a generic framework (JSKit). Once a memory corruption vulnerability yields a JS-level primitive (e.g., arbitrary read/write on typed arrays or objects), JSKit handles the rest: it parses in-memory Mach-O binaries to resolve symbols, builds PAC bypass chains for the current iOS version, and manually maps Mach-O payloads directly from memory to execute native code without touching disk. To reuse this trick for new WebKit bugs, an attacker only needs to adapt the initial primitive to JSKit’s expected interface and let JSKit abstract away PAC and version differences, enabling rapid reuse of a single exploitation framework across many RCE bugs.

Chaining renderer RCE, kernel IPC UAF, and code-signing b...

🤖 Agent Actions

Summary:

• Expanded src/binary-exploitation/ios-exploiting/README.md with a new section detailing Intellexa’s reusable Safari exploitation stack (JSKit renderer framework, IPC UAF + code-sign bypass bridge, and PREYHUNTER helper/watcher behaviors), highlighting the chain’s primitives, anti-analysis logic, and stealthy staging capabilities.
• Added detection-focused guidance covering PREYHUNTER artifacts, hashes, CI paths, and the published YARA hunting rule inside an expandable block for analysts.
• Introduced a “References” section citing Google Threat Intelligence’s Intellexa report to document the new material.

Testing: Not run (documentation-only changes).

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://cloud.google.com/blog/topics/threat-intelligence/intellexa-zero-day-exploits-continue

Content Categories: Based on the analysis, this content was categorized under "Binary Exploitation -> Chrome Exploiting (for the TheHole-based V8 framework) and iOS Exploiting (for JSKit, iOS chain pattern, kernel UAF + code-signing bypass); also cross-linked from Mobile Pentesting -> iOS Pentesting and Generic Methodologies & Resources -> Basic Forensic/ Malware Analysis (for anti-analysis, staging, and YARA-based hunting patterns).".

Repository Maintenance:

• MD Files Formatting: 915 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0