Google details three campaigns using Predator spyware built by North Macedonian developer Cytrox which exploited five Android vulnerabilities discovered in 2021
New research from Google's Threat Analysis Group outlines the risks Android users face from the surveillance-for-hire industry. Source: The Keyword .
Context & Ripple Effects
Google's Threat Analysis Group has turned commercial spyware into a recurring publication beat: weeks after this Predator disclosure, the same team detailed the Hermit spyware used in Kazakhstan and Italy, whose iOS build carried six exploits including two zero-days. The Predator report is an earlier data point in that series — three campaigns traced to North Macedonia's Cytrox, riding five Android vulnerabilities found in 2021.
The throughline matters because these are vendor-side exposés, not law-enforcement takedowns: Google is naming the developer (Cytrox) and enumerating the exploit chain itself, which sets up the follow-on 2023 TAG report on further zero-day campaigns against Android, iOS, and Chrome.
First-order effects
- Android users targeted by the three Predator campaigns get patched defenses once Google closes the five exploited vulnerabilities, while Cytrox loses working access to those devices.
Second-order effects
- Other surveillance-for-hire vendors in Google's crosshairs — RCS Lab's Hermit among them — face the same exposure model: named developers, published exploit details, and faster platform patching that raises their re-acquisition costs.
Third-order effects
- If the TAG disclosure cadence holds, mercenary spyware economics shift toward continuous exploit replenishment, pushing the industry toward the harder-to-attribute delivery channels seen later in the year with spyware distributed outside the Play Store.
The trend: Platform vendors are becoming the primary investigators of the commercial spyware industry, using disclosure and patch velocity rather than legal action as the countermeasure.