Intellexa’s Predator spyware used to hack iPhone of journalist in Angola, research says

Recent research from Amnesty International has revealed that a government client of the controversial spyware firm Intellexa successfully hacked the phone of a well-known journalist in Angola. This alarming incident underscores the ongoing threats faced by civil society activists from advanced hacking tools. Amnesty's report, released on Tuesday, detailed multiple hacking attempts against Teixeira Cândido, a local journalist and advocate for press freedom. In 2024, Cândido received a series of malicious links via WhatsApp, ultimately clicking on one that compromised his iPhone with Intellexa's spyware, known as Predator. This incident is part of a broader trend where commercial surveillance technology is being employed by governments to target journalists, political figures, and ordinary citizens who voice dissent. Previous investigations have documented the misuse of Predator in countries like Egypt, Greece, and Vietnam, where it has been used to infiltrate the devices of U.S. officials through deceptive links on social media. Intellexa, which has faced sanctions, is notorious for its evasive operational tactics, employing a complex network of corporate structures to navigate export regulations. In light of Cândido’s case, it was revealed that the Biden administration had sanctioned Intellexa, including its founder Tal Dilian and partner Sara Aleksandra Fayssal Hamou, around the same time the journalist was targeted. Despite these actions, there are concerns about Intellexa's continued operations and the effectiveness of the sanctions, particularly after three other executives were recently cleared of sanctions, prompting inquiries from Senate Democrats. Amnesty's forensic analysis connected the hacking to Intellexa through specific digital traces found on Cândido’s device, which pointed to the use of infection servers associated with the company. Interestingly, after Cândido rebooted his phone—an action that removed the spyware—researchers noted that the malware had cleverly disguised itself as legitimate iOS system processes to evade detection. The findings suggest that Cândido may not be the only target within Angola, as multiple domains linked to Intellexa's spyware have been identified in the country, with evidence of their deployment dating back to March 2023. However, the report does not definitively identify the specific entity that commissioned the hacking operation. Despite the scrutiny and sanctions surrounding Intellexa, Amnesty's research indicates that the company remains active and continues to pose a significant risk. "We have now documented confirmed abuses in several countries, including Angola, Egypt, Pakistan, and Greece, and for every case we uncover, many more abuses are likely hidden from view," stated Donncha Ó Cearbhaill, head of Amnesty's security lab.