For most of the past decade, “nation-state hacking” conjured images of intelligence agencies writing their own malware. That is no longer the whole picture. A commercial market now sells intrusion as a service. Private vendors build the exploit chains, package the spyware, and lease turnkey surveillance platforms to government customers. The products carry names that have surfaced in courtrooms, sanctions filings, and forensic labs: Predator, Hermit, Pegasus, and others. This is the world of mercenary spyware, and Android is squarely in its attack surface.

Two families illustrate the threat with unusual clarity because researchers documented them so thoroughly: Predator, built by Cytrox and sold through the Intellexa alliance, and Hermit, attributed to the Italian vendor RCS Lab. Both have been used against journalists, opposition politicians, and activists. Both abuse the same reservoir of Android permissions that legitimate apps use every day. And both show how a single tap on a link, or in the worst cases no tap at all, can turn a personal phone into a hostile listening device.

This article is a defensive briefing. It explains how mercenary spyware reaches Android devices, which vulnerabilities and permissions it exploits, what the documented campaigns actually looked like, how the U.S. government has responded, and what high-risk users and organizations can do about it. There are no operational instructions here, only the knowledge needed to reduce risk and recognize a compromise.

What “Mercenary Spyware” Means

Mercenary spyware, sometimes called commercial surveillance software, is intrusion software developed and sold by private companies rather than written in-house by a government. The vendor supplies the full kill chain: the delivery infrastructure, the exploit chain that defeats a modern phone’s defenses, the implant that lives on the device, and often a management console for the operator.

The defining features that separate this from ordinary malware are quality and stealth. These are not commodity banking trojans. They are built around zero-day vulnerabilities, sometimes chained several deep, and in the most advanced cases they achieve zero-click compromise, where the target never has to interact with anything at all. The vendors market plausible-sounding uses, counterterrorism and criminal investigations, but the documented reality is a long record of deployment against civil society. Because the product is a threat actor’s toolkit rented rather than owned, attribution becomes murky: the vendor builds it, but a government customer aims it.

How Mercenary Spyware Reaches an Android Phone

Delivery is where these operations begin, and it is also where defenders have the most visibility. Documented campaigns rely on three broad techniques.

One-Time Links

The most common vector is a single-use link crafted for one specific target. Google’s Threat Analysis Group (TAG) documented Cytrox delivering Predator through one-time links that mimicked URL-shortener services, sent to targets by email or SMS. The links were single-use for a reason: they defeat casual analysis. Click it once and the exploit chain fires; visit it later, or from the wrong device, and the server quietly redirects to a legitimate website so investigators find nothing. This is a hallmark of a professional operation designed to minimize the exposure of its exploits.

One-Time SMS Posing as Trusted Messages

In the Predator campaign against Egyptian opposition figure Ahmed Eltantawy, Citizen Lab documented fraudulent text messages disguised as WhatsApp notifications carrying links to Predator infection sites, spread across 2021, 2023, and again in 2023. The social engineering is deliberately mundane: a message that looks like an ordinary app alert lowers the target’s guard.

Network Injection

The most aggressive vector removes the need to fool the target at all. In the same Eltantawy case, Citizen Lab found that a device installed at the border of Vodafone Egypt’s network silently redirected his phone to a malicious site when he browsed to certain non-encrypted websites. The researchers attributed the redirection with high confidence to a Sandvine PacketLogic appliance. This is network injection: the operator, with ISP-level access, intercepts ordinary web traffic and injects the exploit into it. The victim simply browses the web, and the compromise happens in transit.

Hermit added its own twist to ISP-assisted delivery. According to Google TAG, in some Hermit cases the operators appear to have worked with the target’s ISP to disable the victim’s mobile data, then sent an SMS urging the target to install an application to “restore” connectivity. The malicious app masqueraded as a mobile-carrier or legitimate vendor application. The engineered problem created the pretext for the malicious fix.

Predator and the ALIEN Loader

Predator is the spyware payload; it does not arrive alone. Cisco Talos, Citizen Lab, and Google TAG have all analyzed the pairing of Predator with a component called ALIEN. ALIEN is more than a simple dropper. In Talos’s analysis it acts as both loader and executor, running inside privileged Android processes, handling initialization, and communicating continuously with the Predator payload. Predator itself is delivered as a packed executable bundling Python modules and native code, which ALIEN launches on the device.

Once resident, Predator’s documented capabilities read like a full surveillance suite. Talos’s technical analysis describes it hooking Android’s audio libraries to capture microphone input and VoIP calls, recursively harvesting databases of contacts, call logs, and SMS/MMS, and reaching into the data of messaging apps including Signal, WhatsApp, and Telegram. It has been observed installing malicious certificates into the user-trusted certificate store to enable interception, and using custom hooks for persistence and to hide itself from the package manager. To get this access it injects into privileged system processes such as zygote64 and system_server, bypassing the sandboxing that normally isolates apps from each other.

The Predator Exploit Chains

Predator’s operators have burned real zero-days to get onto devices. In its May 2022 report, Google TAG attributed several Chrome vulnerabilities and an Android kernel bug to Cytrox campaigns: CVE-2021-37973, CVE-2021-37976, CVE-2021-38000, and CVE-2021-38003 in Chrome, and CVE-2021-1048 in the Android kernel. These were delivered through the one-time email links described above.

The September 2023 Egyptian campaign was more elaborate and cut across two platforms. On Android and Chrome, Google TAG recovered the initial renderer remote-code-execution vulnerability, CVE-2023-4762, a type-confusion flaw in Chrome’s V8 JavaScript engine that had been separately reported to Google and patched on September 5, 2023. On the iOS side of the same operation, Citizen Lab and Apple documented a three-bug chain, CVE-2023-41991, CVE-2023-41992, and CVE-2023-41993, spanning signature validation, kernel privilege escalation, and WebKit code execution. That a single operator held working chains for both ecosystems underscores the resources behind these products.

Hermit and RCS Lab

Hermit is attributed to RCS Lab, an Italian surveillance vendor, and was documented in parallel by Google TAG and by mobile-security firm Lookout, which first analyzed a sample deployed in Kazakhstan. Google TAG reported victims in Italy and Kazakhstan, reached through the ISP-assisted, drive-by delivery described earlier.

On Android, Hermit does not pack all of its capability into the initial app. Lookout’s analysis describes a modular design: the implant downloads additional components at runtime using Android’s DexClassLoader, letting operators enable specific functions on demand. Those modules cover the surveillance essentials, call recording, location tracking, camera access, and data exfiltration, and Google TAG noted the Android implant’s ability to exfiltrate files such as the target’s WhatsApp database. Because Hermit requests broad permissions when the victim sideloads the disguised app, much of its power comes not from an exotic exploit but from the user being tricked into granting access.

The Permissions Under Attack

Whether the entry point is a kernel exploit or a duped user tapping “Allow,” the endgame is the same: access to the sensors and data stores that make a smartphone intimate. Understanding the abused permissions is the core of understanding the threat.

Microphone. Ambient audio and call capture. Predator hooks audio libraries directly; other implants request the standard record-audio permission.
Camera. Silent photo and video capture from an app the user believes is idle.
Location. Continuous, precise tracking through GPS and network-location permissions, turning the device into a movement log.
SMS and call logs. Reading texts and call history exposes two-factor authentication codes and the full map of who a target communicates with.
Contacts. The target’s entire social graph, valuable both for intelligence and for choosing the next victim.
Storage and app data. Access to photos, documents, and the local databases of messaging apps. This is how end-to-end encryption is defeated, not by breaking the cryptography but by reading the messages after they are decrypted on the device.
Accessibility services and device admin. Legitimate features for assistive technology and enterprise management, frequently abused by malicious apps to read screens, capture input, and resist removal.

The uncomfortable truth is that none of these permissions are inherently malicious. Every one is used by apps people trust daily. That overlap is exactly what lets spyware hide in plain sight, and why permission hygiene alone is not a complete defense against an exploit chain that grants itself system privileges.

The U.S. Government Response

The scale of documented abuse pushed the commercial spyware industry from a niche research topic into a policy priority, and the U.S. government’s response has been concrete.

The Commerce Department’s Bureau of Industry and Security (BIS) has used the Entity List, an export-control blacklist, against multiple vendors. In November 2021, BIS added NSO Group and Candiru for developing and supplying spyware used to target officials, journalists, and activists. On July 18, 2023, BIS added four entities tied to the Predator ecosystem, Intellexa S.A. (Greece), Cytrox Holdings Crt (Hungary), Intellexa Limited (Ireland), and Cytrox AD (North Macedonia), for “trafficking in cyber exploits used to gain access to information systems, threatening the privacy and security of individuals and organizations worldwide.” Entity List placement sharply restricts these companies’ access to U.S. technology and signals that Washington treats them as a security threat.

Separately, on March 27, 2023, President Biden signed Executive Order 14093, “Prohibition on Use by the United States Government of Commercial Spyware That Poses Risks to National Security.” The order restricts federal agencies from operationally using commercial spyware that poses counterintelligence or human-rights risks, a recognition that even a customer government can be endangered when it buys these tools, since the vendor, its other clients, and the exploits themselves become a shared attack surface.

For defenders, the practical takeaway from CISA and its international partners is that this is now treated as a mainstream threat, not a fringe concern. CISA has published mobile-security guidance and repeatedly warned that spyware targeting messaging-app users is an active danger to high-risk individuals.

Defending High-Risk Users and Organizations

Not everyone is a realistic target for a mercenary spyware operation; these tools are expensive and are aimed with intent. But journalists, activists, dissidents, executives with sensitive access, attorneys, and people connected to contested politics fall inside the threat model. For them, and for the organizations that support them, defense is layered.

Patch Relentlessly

Every documented Predator and Hermit chain relied on vulnerabilities that were eventually patched. Enable automatic updates for Android itself and for Chrome, and apply monthly Android security patches without delay. A device running current software is not immune, but it removes the exact bugs these operators have already spent money to acquire and forces them to burn new ones.

Keep Google Play Protect On

Google Play Protect scans apps on the device, including sideloaded ones, and flags known-malicious behavior. Keep it enabled, install apps only from the official Play Store, and treat any prompt to “enable installation from unknown sources” as a red flag, precisely the step Hermit’s disguised carrier app depended on.

Use High-Risk Hardening for High-Risk People

For individuals who are plausible targets, aggressive hardening is warranted. On Android that means minimizing installed apps, auditing and revoking unnecessary permissions (especially microphone, camera, location, SMS, and accessibility), disabling sideloading, and considering security-focused device configurations. The broader principle behind Apple’s Lockdown Mode, deliberately shrinking the attack surface by turning off convenience features that exploit chains rely on, applies to any high-risk user regardless of platform: fewer capabilities exposed means fewer things to exploit.

Practice Delivery-Stage Skepticism

Because so much delivery depends on links, human vigilance still matters. Treat unexpected links with suspicion even when they appear to come from a known service like WhatsApp or a mobile carrier, and be wary of any message that manufactures urgency, such as a claim that your data connection is broken and can only be fixed by installing an app. When connectivity behaves strangely, verify through your carrier’s official channels rather than a link in a text.

Verify Devices and Preserve Evidence

Suspected compromise is a forensic problem, not a guessing game. Signs worth investigating include unexplained battery drain, unexpected data usage, a hot device when idle, or strange behavior after clicking a link. If compromise is suspected, avoid wiping the device impulsively, that destroys the evidence needed to confirm and attribute the intrusion, and instead preserve it and engage professional mobile forensics. Trained examiners can acquire device images, analyze indicators of compromise, and identify implant artifacts using disciplined methodology. For organizations, that capability should be paired with an incident-response plan that treats a targeted mobile compromise as the serious breach it is.

Build Protective Intelligence Around the People at Risk

Technical controls protect devices; protective intelligence protects people. Organizations whose staff face elevated risk benefit from understanding who might target them and why, monitoring for the social-engineering patterns that precede an attack, and preparing a response before an incident rather than during one.

Conclusion

Predator and Hermit are not theoretical. They are documented, commercially produced surveillance platforms that have compromised real Android phones through real exploit chains and real permission abuse, aimed at real people. The exploits get patched and the vendors get sanctioned, but the market adapts, and the fundamental attack surface, a powerful, always-connected, sensor-laden device carried everywhere, does not shrink. The defensible position is a combination of relentless patching, disciplined permission and app hygiene, hardening for those genuinely at risk, and the forensic readiness to detect and prove a compromise when prevention falls short.

Honeybadger Solutions LLC is a Service-Disabled Veteran-Owned Small Business providing cybersecurity, digital forensics, incident response, and private investigations. If you or your team may be a target for surveillance spyware, our specialists can help with mobile-device forensics, spyware detection, incident response, and protective intelligence. Reach out to talk through your risk before it becomes an incident.

About Honeybadger Solutions

Honeybadger Solutions LLC is a Service-Disabled Veteran-Owned Small Business (SDVOSB) delivering cybersecurity, digital forensics, and investigative services to clients nationwide. Whether you are dealing with a compromised device, a suspected intrusion, or you simply want to get ahead of these threats, our team can help.

What we do:

Digital forensics — mobile devices (iPhone, Android) and computers (Windows, macOS, Linux); intrusion reconstruction, evidence preservation, and expert-witness reporting
Cybersecurity & incident response — breach investigation, containment, malware and spyware analysis, and remediation
Penetration testing & security assessments — finding the gaps before an attacker does
Managed IT & endpoint security — hardening, monitoring, and patch management for small and mid-sized organizations
Private investigations — including TSCM / technical surveillance countermeasures (“bug sweeps”)
Executive & personal protection

📞 (602) 725-2818 · 🌐 honeybadgersolution.com · Veteran-Owned (SDVOSB) · Licensed & Insured

Concerned a device or network may already be compromised? Contact Honeybadger Solutions for a confidential consultation — we handle mobile and computer forensics, incident response, and everything above.

Related from the Honeybadger Android device-security series

Part of Honeybadger Solutions’ security-intelligence series. Explore the rest of the Android coverage:

Mercenary Spyware on Android: Predator, Hermit, and the Permissions They Exploit