Intellexa spyware used to target journalist in Angola

Amnesty International published a new report on Tuesday detailing how a government customer of Intellexa used Predator, a commercial spyware product, to hack the phone of journalist and press freedom activist Teixeira Cândido in Angola. According to the report, the journalist was targeted throughout 2024 with a series of malicious links sent via WhatsApp. Cândido eventually clicked on one of the links, resulting in his iPhone being compromised by the spyware.

Amnesty researchers linked the intrusion to Intellexa by analyzing forensic traces on Cândido’s phone, identifying infection servers previously associated with the company’s infrastructure. Although Cândido rebooted his phone several hours later—which wiped the spyware—the software had stayed hidden by impersonating legitimate iOS system processes to avoid detection. Amnesty noted that it was not clear how the spyware was capable of hacking the phone, which was running an outdated version of iOS at the time.

The incident highlights how Intellexa has remained active in recent years despite controversies and U.S. sanctions. In 2024, the U.S. government imposed sanctions on the spyware maker, as well as its founder Tal Dilian and his business partner Sara Aleksandra Fayssal Hamou. Amnesty researchers suggest that Cândido may be just one of many targets in Angola. The organization found that multiple domains linked to the spyware maker were deployed in the country as early as March 2023, indicating the start of Predator testing or deployment.

Amnesty researchers noted that it is not currently possible to conclusively identify the specific customer of the Predator spyware in Angola. However, the incident fits a broader pattern of commercial surveillance. Researchers have previously documented Predator abuses in countries including Egypt, Greece, and Vietnam. Donncha Ó Cearbhaill, the head of the security lab at Amnesty International, warned of the scale of these operations: “We’ve now seen confirmed abuses in Angola, Egypt, Pakistan, Greece, and beyond — and for every case we uncover, many more abuses surely remain hidden.”

Why it matters

The report underscores that U.S. sanctions have failed to stop Intellexa’s Predator spyware from being deployed by government customers to target journalists and civil society members across multiple countries.