Spyware Firm Intellexa Resurfaces, Linked to Skincare Company and Complex Network of Shell Entities
Table of Contents
A resurgence in activity from Intellexa, the controversial consortium behind the Predator spyware, has raised fresh concerns about its reach and tactics, even as key figures appear to be concealing their involvement through a network of companies – including an unlikely skincare business. After facing sanctions from the United States in 2024, the group appeared to scale back operations, but recent reports indicate a renewed push to deploy its surveillance technology in countries with questionable human rights records.
Predator Spyware’s Renewed Reach
Cyber threat researchers with the Insikt Group reported in June 2025 a “resurgence” in Intellexa’s activities, identifying more than a dozen countries where Predator spyware is believed to be operating. These include Saudi Arabia, the Democratic Republic of the Congo, and Kazakhstan, nations frequently criticized for their human rights records. The report also highlighted that those operating the spyware have adopted new methods to evade detection and mask their identities.
Intellexa’s Predator spyware is capable of comprehensive mobile phone surveillance, allowing its customers to access any information stored on, or transmitted from, a target’s device. The U.S. government sanctioned Intellexa and its senior figures twice in 2024, citing the spyware’s use in covertly monitoring American officials, journalists, and policy experts. Despite these sanctions, Intellexa has not faced similar action from the European Union, allowing its key personnel to continue operating freely within the EU.
From Surveillance to Skincare: The Curious Case of Medovie
An unexpected connection to Intellexa has emerged in the form of Medovie, a skincare company that seemingly sprung back to life online. Sara Hamou, a central figure in establishing Cyprus as a hub for Intellexa’s operations, co-founded the company. According to The Successful Founder magazine, Hamou invested “all my savings” in launching Medovie, which promotes a blend of traditional Chinese medicine and Western research.
The company initially operated through a Cypriot firm, but its website went offline shortly after sanctions were imposed on Intellexa and Hamou. However, earlier in 2025, Medovie’s website resumed operations, now operating through a Portuguese company called MDV Skin Care.
A Web of Connections: Jastrzebska, Levy, and the Shifting Ownership
The ownership of MDV Skin Care reveals a deeper connection to Intellexa. According to the Portuguese corporate registry, the company is owned by Sylwia Jastrzebska, a 26-year-old Polish citizen. Jastrzebska previously served as the director of Cytrox, a sanctioned North Macedonian company that developed Predator spyware for Intellexa.
Her appointment at Cytrox followed a peculiar incident: a Czech reporter visited the home of the previous director, a 70-year-old pensioner, who claimed to have no knowledge of the company. This raises serious questions about the use of shell companies and nominee directors to obscure the true ownership and control of Intellexa’s network.
Jastrzebska’s connections extend beyond MDV Skin Care. She also serves as the president of the board of Douro Dynamics, a Warsaw-based company owned by Amos Levy, an Israeli-Portuguese businessman. In June 2024, Levy incorporated a Portuguese company called Odyssey in the Sky and used it to acquire a Cyprus-based company from Tal Dilian, Intellexa’s founder and Hamou’s ex-husband – a former commander of an elite Israeli intelligence unit.
Levy’s path to Portuguese citizenship is also noteworthy. He obtained citizenship after receiving a certificate confirming his descent from Sephardic Jews, issued in 2017 by the Jewish Community of Porto. He also owns Tamani s.r.o in the Czech Republic, purchased from Amos Uzan, an Israeli businessman with a background in security and communications for the Israeli government. Notably, another firm initially owned by Uzan’s wife, Petra, was also transferred to Levy through Tamani. Petra’s mother was the same 70-year-old pensioner who was unknowingly listed as a director of Cytrox before Jastrzebska took over.
Data Privacy Concerns and Lack of Transparency
Medovie’s privacy policy states that it shares clients’ personal data with other unnamed companies within the “Medovie Group,” located in Israel, Cyprus, and Switzerland. This raises concerns about the potential misuse of sensitive customer information, particularly given the company’s links to a notorious spyware vendor.
When questioned by the Investigative Consortium of Journalists (ICIJ) and the Portuguese publication Expresso, a Medovie spokesperson insisted the firm “is — and has always been — a skincare company” and denied sharing personal data. However, the spokesperson declined to identify the other companies within the “Medovie Group” or address questions about the involvement of Hamou and Dilian. Hamou, Dilian, and Jastrzebska themselves did not respond to inquiries from ICIJ.
Adding another layer to the complex network, Jastrzebska is an active Google reviewer, frequently posting opinions on businesses and restaurants in the Czech Republic, the United Arab Emirates, and Portugal. Last year, she even left a comment on a villa owned by Levy in northern Portugal, describing it as “a true paradise.”
The intricate web of companies and individuals connected to Intellexa, and the apparent use of shell entities to obscure ownership, underscores the challenges in holding the spyware vendor accountable. The resurgence of Intellexa’s activities, coupled with the emergence of seemingly unrelated businesses like Medovie, suggests a sophisticated effort to circumvent sanctions and continue its operations in the global surveillance market.
