Hustler Words – A recent investigation by human rights organization Amnesty International has brought to light a disturbing incident where a prominent Angolan journalist’s iPhone was compromised by the sophisticated Predator spyware, developed by the controversial firm Intellexa. This event underscores a growing global concern: the weaponization of advanced surveillance technology by government entities against members of civil society, particularly those critical of authority.
The human rights watchdog published a comprehensive report this Tuesday detailing multiple attempts to infiltrate the device of Teixeira Cândido, a notable local journalist and staunch advocate for press freedom. Throughout 2024, Cândido was subjected to a barrage of malicious links sent via WhatsApp. Ultimately, he clicked on one of these deceptive links, leading to the successful infiltration of his iPhone by Intellexa’s Predator spyware, as confirmed by Amnesty’s forensic analysis.
This new evidence further illustrates a troubling pattern: commercial surveillance vendors’ government clientele are increasingly deploying powerful spyware to monitor journalists, political figures, and other private citizens, including dissenting voices. Prior research has documented instances of Predator’s misuse in regions such as Egypt, Greece, and Vietnam, where the software was reportedly used to target U.S. officials through links disseminated on platforms like X.
Intellexa has emerged as one of the most contentious spyware manufacturers in recent years. The company has been accused of operating across various jurisdictions to circumvent export regulations, utilizing what a U.S. government official previously described as an "opaque web of corporate entities" to obscure its activities. In 2024, concurrently with the targeting of Cândido, the outgoing Biden administration imposed sanctions on Intellexa, its founder Tal Dilian, and his business partner Sara Aleksandra Fayssal Hamou. Earlier this year, the Treasury Department’s decision to lift sanctions on three other Intellexa executives prompted strong demands for answers from Senate Democrats. Dilian has not publicly responded to requests for comment regarding these allegations.
Amnesty researchers meticulously linked the intrusions to Intellexa by examining forensic traces discovered on Cândido’s device. Their findings indicated that Intellexa leveraged infection servers previously associated with the company’s established spyware infrastructure. Interestingly, Cândido’s phone was running an outdated version of iOS at the time of the attack. Several hours after clicking the malicious link, a simple reboot of his device inadvertently wiped the spyware. Researchers noted that Predator maintained its stealth by masquerading as legitimate iOS system processes to evade detection.
Based on their findings, which include the discovery of multiple domains linked to the spyware maker active in Angola, Amnesty International suspects that Cândido may be just one of many targets within the country. "The first domains linked to Angola were deployed as early as March 2023, indicating the start of Predator testing or deployment in the country," stated Amnesty researchers in their report. However, they emphasized that conclusive identification of the specific Predator spyware customer in Angola remains elusive.
Last year, leaked internal documents further revealed that Intellexa employees possessed remote access capabilities to their customers’ systems, potentially granting the spyware maker direct insight into government surveillance operations. These leaks, alongside the latest report, highlight Intellexa’s continued operational presence despite mounting controversies and international sanctions.
Donncha Ó Cearbhaill, head of the security lab at Amnesty International, underscored the broader implications: "We’ve now seen confirmed abuses in Angola, Egypt, Pakistan, Greece, and beyond – and for every case we uncover, many more abuses surely remain hidden." The ongoing proliferation and use of such powerful surveillance tools continue to pose a significant threat to privacy, human rights, and the integrity of democratic processes worldwide.
Lorenzo Franceschi-Bicchierai is a Senior Writer at Hustler Words, specializing in hacking, cybersecurity, surveillance, and privacy.
Leave a Comment