Predator Spyware Infection of Angolan Journalist via WhatsApp Links
Amnesty International reported that the iPhone of Angolan journalist and press freedom advocate Teixeira Cândido was infected with Intellexa’s Predator spyware after he received multiple malicious links via WhatsApp in 2024. According to the investigation, Cândido was messaged from an unknown Angolan number over several weeks; he clicked one link on May 4, 2024, after which Predator was installed, and the spyware was later removed the same day when the device was restarted. Amnesty described this as the first documented Predator case in Angola, and said attribution remains unclear, though the activity is consistent with use by a government customer.
The reporting underscores continued alleged abuse of commercial spyware against civil society despite international pressure on Intellexa. Intellexa and associated individuals have faced U.S. actions including placement on the Entity List and subsequent sanctions (with later changes to some designations noted in coverage), yet Predator has been repeatedly linked to targeting of journalists and officials in multiple countries. Amnesty’s findings add to prior public reporting on Predator’s use in places such as Greece, Egypt, and Vietnam, reinforcing the ongoing risk posed by link-based mobile spyware delivery through common messaging platforms like WhatsApp.
Timeline
Feb 18, 2026
Amnesty discloses first confirmed Predator case in Angola
Amnesty International publicly reported that Predator had been used to infect the iPhone of Angolan journalist Teixeira Cândido in May 2024, calling it the first documented use of the spyware in Angola and attributing it to a government customer of Intellexa.
Sep 1, 2024
U.S. sanctions Intellexa executives and consultants
In September 2024, the U.S. imposed sanctions on Intellexa executives and consultants, escalating pressure on the company and its leadership over spyware-related concerns.
May 4, 2024
Phone reboot removes Predator infection the same day
A reboot a few hours after the compromise on 2024-05-04 removed the spyware from Cândido's device, limiting the duration of the infection.
May 4, 2024
Predator infects Angolan journalist's iPhone via WhatsApp link
On 2024-05-04, Teixeira Cândido clicked a malicious WhatsApp-delivered link from an unknown Angolan number, after which Intellexa's Predator spyware was installed on his iPhone. Amnesty later identified forensic traces and infrastructure consistent with Predator.
Apr 1, 2024
Attacker begins social engineering campaign against Teixeira Cândido
An operator posing as students reportedly spent weeks building trust with Angolan journalist Teixeira Cândido over WhatsApp before sending multiple malicious links, indicating a targeted surveillance effort.
Jul 1, 2023
U.S. places Intellexa on the Entity List
The U.S. government added Intellexa to the Entity List, a move later cited as part of the ongoing scrutiny surrounding the spyware vendor's continued operations.
Mar 1, 2023
Predator-linked infrastructure appears in Angola
Amnesty found Predator-linked domains used in Angola, with the earliest infrastructure deployed as far back as March 2023, suggesting testing or operational setup in the country had begun by then.
See the full picture in Mallory
Mallory subscribers get deeper analysis on every story, including:
Who’s affected and how
Deep-dive technical analysis
Actionable next steps for your team
IPs, domains, hashes, and more
Ask questions and take action on every story
Filter by topic, classification, timeframe
Get matching stories delivered automatically
Related Entities
Sources
Related Stories
European Spyware Scandals Involving Predator and Paragon Targeting Journalists and Civil Society
A Greek court sentenced **four Intellexa executives** to **eight years in prison** for their role in the “**Predatorgate**” spyware scandal, which involved use of **Predator** spyware against **90+ public figures**. Prior investigations by **The Citizen Lab** and others documented Predator’s presence in Greece and confirmed infections on devices belonging to journalist **Thanasis Koukakis** and former Meta trust-and-safety manager **Artemis Seaford**, marking a rare case where executives at a mercenary spyware firm faced criminal conviction and prison time. In Italy, prosecutors in Rome and Naples confirmed via a technical report that journalist **Francesco Cancellato** and immigration activists **Giuseppe Caccia** and **Luca Casarini** showed traces consistent with **Paragon Solutions** spyware infections during the early hours of **2024-12-14**, suggesting a coordinated infection campaign. Italian authorities also inspected a Paragon spyware server used by the intelligence agency **AISI** and found evidence of operations against Caccia and Casarini but not against Cancellato, leaving attribution for Cancellato’s compromise unresolved; the case follows **WhatsApp** notifications to roughly **90** people warning they were targeted with Paragon spyware.
1 months ago
Ongoing Global Deployment and Corporate Expansion of Intellexa Predator Spyware
Researchers have uncovered continued deployment of the Predator spyware, developed by Intellexa, in multiple countries despite U.S. sanctions and increased scrutiny. New evidence indicates active use in Iraq, with additional operations linked to entities in Pakistan, Saudi Arabia, Kazakhstan, Angola, and Mongolia. Some countries, such as Egypt, Botswana, and Trinidad and Tobago, appear to have ceased communication with Intellexa, though this may reflect changes in infrastructure rather than a halt in activity. The spyware has been used against civil society members, business executives, and other high-value targets, with its costly licensing model suggesting a focus on strategic individuals. Ongoing legal proceedings against former Intellexa executives in Greece highlight the international concern over the company's activities. Recorded Future’s Insikt Group has mapped a complex global network of individuals and entities associated with Intellexa, including those involved in backend development, infrastructure setup, and product distribution. Export and import data reveal that Intellexa’s products have been shipped to clients in various regions, with new evidence of product imports in Kazakhstan and the Philippines. The network also includes entities in the advertising sector potentially linked to the "Aladdin" ad-based infection vector. The persistent and likely unlawful use of Predator spyware continues to pose significant privacy, legal, and physical security risks, particularly for political opposition, business leaders, and individuals in sensitive roles worldwide.
1 months ago
Intellexa Executives Sentenced in Greece Over Predator Spyware Wiretapping Scandal
A Greek court in Athens sentenced **Intellexa** founder **Tal Dilian** and three associates—**Sara Hamou**, **Felix Bitzios**, and **Yiannis Lavranos**—to prison for their roles in the “Greek Watergate” spyware scandal involving illegal wiretapping and privacy violations tied to Intellexa’s *Predator* spyware. Local reporting cited by multiple outlets indicates the court imposed sentences totaling more than **126 years**, which under Greek law translate to **eight years** to be served; the court also ordered further investigation, and the defendants are expected to **appeal** and remain free pending the appeal process. The case stems from allegations that *Predator* was used to surveil Greek targets including **politicians, journalists, businesspeople, military officials, and other public figures**, with reporting citing **more than 90** victims in Greece during **2020–2021**. Lavranos’s company **Krikel** was reported to have links to the procurement of *Predator*. The convictions mark a notable legal milestone against a commercial spyware vendor; Intellexa and associated entities have also faced international scrutiny, including **U.S. sanctions** in 2024 over alleged misuse of the spyware, and experts noted the guilty verdict and custodial sentence could increase cross-border legal exposure even if defendants attempt to avoid Greek jurisdiction.
1 months ago