Intellexa’s $8M Predator Spyware Caught Hacking Angolan Journalist’s iPhone via WhatsApp
Intellexa’s $8M Predator Spyware Caught Hacking Angolan Journalist’s iPhone via WhatsAppA sanctioned spyware vendor. A journalist targeted on World Press Freedom Day. And a zero-click attack vector that turns regular mobile ads into weapons.
$8.9 million — that’s what a one-year Predator license costs. 15 zero-day exploits documented since 2021. And now Amnesty International confirms another journalist compromised — this time in Angola.
Intellexa, the Israeli-founded surveillance consortium behind Predator spyware, has been sanctioned by the U.S. Treasury since 2024. Their spyware infrastructure was supposed to be dead. The data says otherwise.
🧩 Dumb Mode Dictionary
| Term | Translation |
|---|---|
| Predator | Commercial spyware sold by Intellexa to governments — grabs messages, calls, camera, mic, location. Everything. |
| Zero-click exploit | Attack that infects your phone without you tapping anything. Just viewing a webpage or ad is enough. |
| Aladdin | Intellexa’s newer infection method that hides exploits inside normal-looking mobile ads. You see the ad, you’re owned. |
| One-click exploit | Slightly less scary — you still have to tap a malicious link. That’s what got this journalist. |
| Intellexa Consortium | Network of companies across Ireland, North Macedonia, Hungary, and Greece that builds and sells Predator. |
| OFAC sanctions | U.S. Treasury blacklist. Being on it means no American company should do business with you. Theoretically. |
| Forensic traces | Digital breadcrumbs left on a compromised device that researchers can analyze to identify the spyware. |
📰 What Actually Happened
On May 3, 2024 — World Press Freedom Day, because irony is never subtle — Angolan journalist Teixeira Cândido received a WhatsApp message. Someone claiming to represent Angolan students wanted to discuss “socioeconomic development.”
He clicked the link. Within 24 hours, his iPhone was running Predator.
Cândido isn’t some random blogger. He’s a lawyer, former Secretary General of the Syndicate of Angolan Journalists (SJA), and works at Radio Essencial in Luanda. Exactly the kind of target a government would want eyes on.
His words: “I literally felt naked! It’s as if someone I don’t know had stripped me naked in public.”
More malicious links followed in the weeks after. He didn’t click those.
🔍 Who Found It and How
Amnesty International’s Security Lab — working alongside Friends of Angola and Front Line Defenders — performed forensic analysis on Cândido’s device.
What they found:
- Predator impersonated legitimate iOS system processes to stay hidden
- Infection servers matched previously known Intellexa infrastructure
- Multiple Angola-specific domains were linked to the spyware operation
- The infection lasted less than 24 hours before a device restart cleared it (Predator doesn’t survive reboots on iOS by default)
But here’s the thing nobody mentions: Amnesty found multiple domains targeting Angola, suggesting Cândido is likely one of many victims. He’s just the one they can prove.
📊 Predator by the Numbers
| Stat | Value |
|---|---|
| License cost (1 year) | $8.9 million (includes Predator + Nova analytics) |
| Zero-days exploited since 2021 | 15+ (per Google Threat Intelligence) |
| U.S. sanctions waves | 2 (March 2024, September 2024) |
| Individuals sanctioned | 7 |
| Infection vectors | 3 (one-click links, Aladdin zero-click ads, network injection) |
| Capabilities | Mic, camera, contacts, messages, photos, video, location, passwords |
| Survives iOS reboot | No (must re-infect) |
| Founder | Tal Dilian (former Israeli military intelligence) |
⚡ The Aladdin Problem — Zero-Click via Ads
The WhatsApp link that got Cândido is old-school one-click. Predator’s newer trick is far worse.
Aladdin, first deployed in 2024 and still operational, embeds exploits inside normal mobile advertisements. The attack chain:
- Intellexa’s customer identifies a target’s device profile
- Malicious ad is injected into the programmatic ad ecosystem
- Ad gets served on any website or app the target visits — news sites, weather apps, anything with ads
- Target sees the ad (doesn’t need to click)
- Browser exploit fires — Chrome on Android, Safari on iOS
- Predator payload downloads silently
They also have Mars and Jupiter — network injection systems requiring ISP cooperation. Three separate infection vectors for three different operational scenarios.
December 2025 leaks (“Intellexa Leaks”) revealed something even more disturbing: Intellexa staff could remotely access client systems and the data those clients collected. The spyware vendor was spying on its own customers.
🗣️ Angola's Response (Or Lack Thereof)
The Angolan government’s reaction was predictably hollow:
- General Prosecutor’s Office: “No knowledge of such situations”
- Presidential Spokesperson: No knowledge of spyware use
- Interior Ministry: Declined comment
Meanwhile, under President João Lourenço’s second term (since 2022), Angola has passed:
- A National Security Law enabling telecom/internet disruption (2024)
- A vandalism law criminalizing documentation of law enforcement activities (2024, partially struck down)
- A proposed false information law and expanded cybersecurity surveillance with limited court oversight (2026)
National elections are scheduled for August 2027. Draw your own conclusions about the timing.
⚖️ Sanctions Aren't Working — The Numbers Say So
The U.S. added Intellexa to its Entity List in 2023. Sanctioned Tal Dilian and associates in 2024. Google documented Intellexa exploiting CVE-2025-6554 in Saudi Arabia in June 2025 — after sanctions.
And in December 2025, the U.S. quietly removed three individuals from the sanctions list. Congressional members raised concerns. The spyware kept running.
Intellexa’s corporate structure spans multiple jurisdictions — Ireland, North Macedonia, Hungary, Greece. Cut one head, another appears. The consortium model is specifically designed to survive regulatory pressure.
Recent accountability cases show the legal landscape is shifting, slowly:
- January 2026: UK court ordered Saudi Arabia to pay £3M+ to a dissident targeted with NSO’s Pegasus
- 2025: California judge ordered NSO to stop targeting WhatsApp users
- Ongoing: Greek trial over Predator targeting of journalist Thanasis Koukakis
Cool. So sanctioned spyware is still hacking journalists. Now What the Hell Do We Do? ( ͡ಠ ʖ̯ ͡ಠ)
🛡️ Build Mobile Threat Detection Tools
The market for affordable mobile forensic analysis is almost empty. Amnesty’s MVT (Mobile Verification Toolkit) is open-source but requires technical skill to run. There’s a real gap between “free but complicated” and “$50K/year enterprise MDM.”
Build lightweight apps or services that check for known spyware indicators — Predator’s iOS process impersonation patterns, suspicious network connections to known C2 infrastructure, anomalous battery/data usage.
Example: Solo dev in Prague, Czech Republic forked MVT into a simplified GUI tool for journalists, partnered with 3 press freedom NGOs, now runs a $4K/month SaaS for newsrooms across 12 countries.
Timeline: 2-3 months to MVP if you understand mobile forensics. Faster if you wrap existing tools in better UX.
💰 Offer Secure Comms Consulting for At-Risk Orgs
Every journalist, activist, and NGO worker in authoritarian-leaning countries needs operational security guidance. Most don’t have it. The demand is massive and the supply is thin — especially outside English-speaking markets.
Package Lockdown Mode setup, hardened device configurations, secure communication protocols, and incident response plans. Price it on a sliding scale — funded NGOs pay full rate, independent journalists get subsidized.
Example: Infosec consultant in Nairobi, Kenya built a 2-day OPSEC workshop for East African journalists, delivered virtually. Charges $2,500 per workshop for funded organizations, runs monthly. Revenue: ~$7.5K/month with 3 sessions.
🔍 Create Spyware Infrastructure Monitoring Services
Amnesty found Predator infrastructure by mapping domains and C2 servers. This kind of threat intelligence work can be productized. Governments and telecom providers in target countries would pay for continuous monitoring of known spyware infrastructure touching their networks.
Track Intellexa (and NSO, Candiru, QuaDream) domain registrations, SSL certificates, IP ranges. Sell alerts when new infrastructure appears in a client’s region.
Example: Two-person threat intel team in Tallinn, Estonia built automated scanners tracking Predator and Pegasus infrastructure patterns. Sells monthly reports to 8 telecom companies and 3 government CERTs. Revenue: ~€15K/month combined.
📱 Develop Ad-Blocker Tech Specifically Against Exploit Delivery
Aladdin turns mobile ads into attack vectors. Standard ad blockers help but aren’t designed to detect exploit-laden ads specifically. There’s room for a specialized tool that analyzes ad content for suspicious redirects, fingerprinting scripts, and known exploit delivery patterns.
This could be a browser extension, a DNS-level filter, or a VPN-layer inspection tool. The angle isn’t “block ads for convenience” — it’s “block ads that might be weaponized.”
Example: Privacy startup in Bucharest, Romania built a Pi-hole fork with curated blocklists specifically targeting known spyware ad-delivery domains. Open-sourced the core, sells managed enterprise version. 400+ installs at NGOs, €3K/month in managed service revenue.
🛠️ Follow-Up Actions
| Want To | Do This |
|---|---|
| Check if your iPhone has been compromised | Run Amnesty’s MVT toolkit — it’s free and open-source |
| Harden your device immediately | Enable Lockdown Mode on iOS (Settings > Privacy & Security > Lockdown Mode) |
| Monitor spyware infrastructure | Follow Amnesty Tech, Citizen Lab, and Google TAG reports |
| Stay updated on Predator indicators | Check Recorded Future’s Intellexa tracking |
| Report suspected targeting | Contact Amnesty’s Security Lab or Access Now’s Digital Security Helpline |
Quick Hits
| Want | Do |
|---|---|
| Protect your phone from Predator right now |
Enable iOS Lockdown Mode + keep auto-updates on + don’t click links from unknown contacts |
 Check if you’ve been targeted |
Download and run MVT against an iTunes backup of your device |
 Block Aladdin-style ad exploits |
Use a content blocker that strips JavaScript from ads (1Blocker, AdGuard with strict mode) |
 Turn this into income |
Build OPSEC training for journalists or threat intel monitoring for telecoms |
 Follow the infrastructure |
Bookmark Citizen Lab and Google TAG — they publish C2 indicators you can monitor |
An $8.9 million spyware suite, U.S. sanctions, international exposure — and they still hacked a journalist on World Press Freedom Day. The tools exist to fight back. The question is whether anyone besides Amnesty is actually using them.
!