> The rising threat of spyware has prompted both Apple and Google to introduce indicators when a device’s microphone or camera are used. But some of the more elusive and more capable spyware — the spyware typically used by governments and nation states — can slip past the hardened defenses built into iOS and Android.

> That’s where Malloc says Antistalker comes in. Malloc’s co-founders Maria Terzi, Artemis Kontou and Liza Charalambous built the app around a machine learning (ML) model, which allows the app to detect and block device activity that could be construed as spyware recording or sending data.

That's a bit of a non sequitur, right?

If sophisticated malware is bypassing the OS-level "open mic" warning, that's presumably because it's bypassed the OS security model. As such, it should just as easily be able to avoid detection or simply disable any other detection mechanism, ML-driven or otherwise.

(If the issue is sophisticated malware that does not involve privilege escalation, e.g. by executing code inside the sandbox of a trusted app, I could see how an improved detection approach would help, but e.g. NSO and similar tend to use sandbox escapes + privesc, AFAIK.)