The Rise of Predator Spyware and Its Global Impact

Predator, developed by the Greek company Intellexa, is a sophisticated mobile phone spyware capable of extracting vast amounts of data from a target’s device, including messages, photos, location data, and even activating the microphone. Unlike some other spyware, Predator is designed to operate stealthily, leaving minimal traces of its presence, making detection exceptionally difficult. Intellexa markets this technology to governments for surveillance purposes, but its use has repeatedly been linked to human rights abuses and the suppression of dissent.

This case marks the first forensic confirmation of Predator’s deployment within Angola. However, it is part of a broader pattern of surveillance threats identified throughout 2025 by organizations like Friends of Angola and Front Line Defenders. Recent investigations, including the Intellexa Leaks, have revealed the continued operation of Predator even after international sanctions were imposed on the company and its executives. These leaks also exposed operations in Pakistan, specifically a 2025 attack on a human rights lawyer in Balochistan province, demonstrating the spyware’s reach extends beyond Angola’s borders.

The targeting of Cândido occurred between April and June 2024, while he served as Secretary General of the Syndicate of Angolan Journalists (SJA). Attackers initiated contact via WhatsApp, posing as students interested in social and economic affairs to build rapport before sending malicious links designed to infect his iPhone with Predator. On May 4, 2024, Cândido inadvertently opened one such link, granting attackers unrestricted access to his device.

Amnesty International’s Security Lab meticulously analyzed Cândido’s phone, identifying network communications indicative of Predator’s presence on May 4th. “Forensic analysis conducted by Amnesty International’s Security Lab confirmed with high confidence that the infection links are tied to Intellexa’s Predator spyware and resulted in at least one successful infection of Teixeira Cândido’s phone,” stated Carolina Rocha da Silva, Operations Manager at Amnesty International’s Security Lab.

While the infection was seemingly removed after a phone restart, attackers continued to send malicious links for weeks afterward. This persistent targeting highlights the determined effort to compromise Cândido’s communications and potentially gather sensitive information.

Did You Know? Predator spyware can access encrypted messaging apps, audio recordings, emails, and even activate a device’s microphone, effectively turning a smartphone into a constant surveillance tool.

The Human Cost of Digital Surveillance

The impact on Teixeira Cândido has been profound. “I feel naked knowing that I was the target of this invasion of my privacy. I don’t know what they have in their possession about my life… Now I only do and say what is essential. I don’t trust my devices. I exchange correspondence, but I don’t deal with intimate matters on my devices. I feel very limited,” he shared. This sentiment reflects the chilling effect that such surveillance has on journalists and activists, forcing them to self-censor and operate under a constant cloud of suspicion.

This attack isn’t an isolated incident. Cândido has faced ongoing intimidation since 2022, including unexplained break-ins at his office. This pattern of harassment, combined with the spyware attack, paints a disturbing picture of a deliberate effort to silence a critical voice in Angola.

The use of Predator spyware also raises broader concerns about the erosion of privacy and freedom of expression. Amnesty International has documented similar abuses in countries around the world, highlighting the need for greater regulation and accountability in the surveillance technology industry. The organization sent a letter to Intellexa on January 27, 2026, requesting information about its human rights due diligence processes, but has yet to receive a response.

The situation in Angola is further complicated by a tightening authoritarian environment under President João Lourenço’s administration, characterized by the repression of peaceful protests, arbitrary arrests, and abuses in detention. This context suggests that the targeting of Cândido may be part of a wider crackdown on dissent.

What responsibility do technology companies have in preventing their products from being used for human rights abuses? And how can international pressure be effectively applied to curb the trade in mercenary spyware?

Frequently Asked Questions About Predator Spyware

• What is Predator spyware and how does it work?

  Predator is a highly invasive spyware developed by Intellexa that infects mobile phones, granting attackers access to personal data, communications, and even the device’s microphone and camera. It operates stealthily, making detection difficult.

• Who is Teixeira Cândido and why was he targeted?

  Teixeira Cândido is a prominent Angolan journalist, press freedom activist, and former Secretary General of the Syndicate of Angolan Journalists (SJA). He was likely targeted due to his work advocating for press freedom and holding power accountable.

• What is Intellexa’s role in the development and sale of Predator spyware?

  Intellexa is the Greek company that develops and sells Predator spyware to governments. Despite facing sanctions and criminal investigations, the company continues to operate and its spyware remains in use.

• How can individuals protect themselves from spyware attacks?

  While complete protection is difficult, individuals can reduce their risk by being cautious about clicking on links from unknown sources, keeping their software updated, and using strong passwords. Consider using encrypted messaging apps and enabling two-factor authentication.

• What is being done to regulate the spyware industry?

  There is growing international pressure to regulate the spyware industry, including calls for greater transparency, accountability, and restrictions on the sale of surveillance technology to governments with poor human rights records. Criminal investigations are ongoing in several countries.

• What are the broader implications of the use of spyware like Predator for press freedom?

  The use of spyware creates a chilling effect on journalism, forcing reporters to self-censor and fear for their safety. This undermines the ability of the press to hold power accountable and inform the public.