A prominent Angolan journalist was targeted with sophisticated spyware, raising fresh concerns about the global trade in digital surveillance tools and its impact on press freedom. Amnesty International reported Tuesday that Teixeira Cândido, a journalist and activist, had his iPhone hacked in 2024 using Predator spyware, developed by the controversial company Intellexa.
The attack underscores a growing trend of governments and their proxies using commercial spyware to monitor journalists, human rights defenders, and political opponents. Cândido, a former Secretary General of the Syndicate of Angolan Journalists (SJA), discovered the intrusion after receiving a series of suspicious links via WhatsApp. Clicking one of those links allowed attackers to install Predator on his device, according to Amnesty’s forensic analysis.
“I feel naked knowing that I was the target of this invasion of my privacy,” Cândido said, according to the Amnesty report. “I don’t know what they have in their possession about my life… Now I only do and say what is essential. I don’t trust my devices.” The incident highlights the chilling effect such surveillance can have on independent reporting and free expression.
Predator Spyware and Intellexa’s Opaque Operations
Predator is a highly invasive form of spyware capable of extracting messages, photos, and location data from targeted devices. Developed and sold by Intellexa, the company has faced increasing scrutiny for its role in enabling governments to conduct surveillance operations. Intellexa operates through a complex network of entities, described by a U.S. Government official as an “opaque web of corporate entities” designed to circumvent export laws, as reported by The Record.
The company and its founder, Tal Dilian, were sanctioned by the outgoing Biden administration in March 2024 for selling spyware used to target Americans. However, earlier this year, the Treasury Department lifted sanctions against three other Intellexa executives, a move that prompted criticism from Senate Democrats who are now seeking answers from the Trump administration, according to Bloomberg.
A Pattern of Abuse
The targeting of Cândido is not an isolated incident. Amnesty International and other researchers have documented the use of Predator spyware in multiple countries, including Egypt, Greece, and Vietnam. In Vietnam, the government reportedly used the spyware to target U.S. Officials, sending malicious links via X (formerly Twitter).
Recent leaks of internal Intellexa documents revealed that the company’s employees may have had remote access to its customers’ systems, potentially allowing them to monitor surveillance operations and identify targets, as TechCrunch reported in December 2025. This raises serious questions about the company’s human rights due diligence and potential liability for misuse of its technology.
Technical Details of the Attack
Amnesty International’s investigation found that the attack on Cândido’s iPhone exploited a vulnerability in the device’s operating system, even though it was running an outdated version of iOS at the time. The spyware was able to remain hidden by disguising itself as legitimate system processes. Researchers linked the intrusion to Intellexa by identifying infection servers previously associated with the company’s spyware infrastructure.
Cândido discovered the hack after his phone unexpectedly rebooted, which wiped the spyware from his device. However, the incident left him deeply concerned about the extent of the data that may have been compromised. Amnesty believes Cândido may be one of many targets in Angola, noting the discovery of multiple domains linked to Intellexa operating within the country.
What Happens Next?
The investigation into the use of Predator spyware continues, with Amnesty International and other organizations working to identify the government customer responsible for targeting Cândido. “We’ve now seen confirmed abuses in Angola, Egypt, Pakistan, Greece, and beyond — and for every case we uncover, many more abuses surely remain hidden,” said Donncha Ó Cearbhaill, the head of the security lab at Amnesty International.
The U.S. Government is expected to continue monitoring Intellexa’s activities and assessing the implications of the lifted sanctions. The Senate Democrats have requested further information regarding the decision to remove the executives from the sanctions list, and a response is anticipated in the coming weeks. The ongoing debate surrounding the regulation of the commercial spyware industry highlights the urgent need for greater transparency, and accountability.
What do you think about the increasing use of spyware by governments? Share your thoughts in the comments below.
Keep reading
