Intellexa’s Predator Spyware Hacked an Angolan Journalist via WhatsApp — Despite US Sanctions
Intellexa’s Predator Spyware Hacked an Angolan Journalist via WhatsApp — Despite US SanctionsA sanctioned spyware vendor keeps selling. A journalist clicked one link. Amnesty found everything.
Intellexa’s Predator spyware — sanctioned by the US in 2023 — was used to hack Angolan journalist Teixeira Cândido’s iPhone in May 2024. The attacker posed as a student on WhatsApp for weeks before sending the kill link. License cost: €13.6 million per deployment.
Amnesty International’s Security Lab published the forensic proof in February 2026. It’s the first confirmed Predator case in Angola, but the infrastructure was active there since March 2023. The sanctions did nothing. The Trump administration even delisted three Intellexa executives in December. This is the commercial surveillance industry working exactly as designed.
🧩 Dumb Mode Dictionary
| Term | Translation |
|---|---|
| Predator | Commercial spyware made by Intellexa. Like Pegasus but from a different vendor. Gives full access to a phone — mic, camera, messages, passwords, location, everything. |
| Zero-day exploit | A software bug the vendor (Apple, Google) doesn’t know about yet. Worth $100K–$300K each on the open market. Predator has burned through 15 since 2021. |
| Social engineering | Tricking a human into clicking something. In this case: fake students sending WhatsApp messages for weeks to build trust. |
| Forensic analysis | Amnesty’s Security Lab reverse-engineering what happened on the phone after the fact. They matched infection servers to known Intellexa infrastructure. |
| Entity List | US Commerce Dept. blacklist. Being on it means US companies can’t sell you stuff. Doesn’t stop you from selling spyware to authoritarian governments, apparently. |
| One-click exploit | Victim has to tap one link (vs. zero-click where they don’t even need to). Still devastating. One tap = full device compromise. |
📖 The Backstory — Who Got Hit and How
Right, so here’s what’s actually happening.
Teixeira Cândido is a prominent Angolan journalist, press freedom activist, jurist, and former Secretary General of the Syndicate of Angolan Journalists. In December 2022, under his leadership, the Syndicate organized a national protest condemning attacks on journalists in Angola.
From April to June 2024, someone posing as students contacted him on WhatsApp. They asked about Angolan social and economic affairs. Standard social engineering — build rapport, seem legitimate, then drop the payload. On May 4, 2024, Cândido clicked one malicious link.
That was it. Full device compromise. Predator had everything: messages, calls, emails, location, camera, microphone, passwords. The spyware disguised itself as a legitimate iOS system process.
Several hours later, Cândido rebooted his phone — which happened to wipe Predator from memory. Between May 4 and June 16, the attacker sent 11 more infection links. All failed, possibly because Cândido didn’t open them. Lucky break.
His own words: “I feel naked knowing that I was the target of this invasion of my privacy. I don’t know what they have in their possession about my life.”
⚙️ Under the Hood — Predator's Technical Stack
Right, so here’s what’s actually happening at the exploit level.
Internally, Intellexa calls their exploit chain “smack.” It’s a three-stage process:
- Stage 1 — Initial Access: Safari RCE zero-day (like CVE-2023-41993). Uses a framework called “JSKit” to get arbitrary memory read/write in the browser renderer
- Stage 2 — Sandbox Escape: Kernel-level flaw for sandbox escape and privilege escalation, plus code-signing bypass
- Stage 3 — Payload: A two-part system called “PREYHUNTER” — a watcher module and a helper module that deploys the actual spyware
Delivery methods include one-time links via encrypted messaging apps. But here’s the fun part — Intellexa also developed “Aladdin,” a system that can infect phones silently through malicious digital ads. You don’t even need to click. Just view the ad.
Google has attributed 15 unique zero-day exploits to Intellexa since 2021. A single weaponized RCE exploit costs $100K–$300K on the market. Predator burns through them like kindling.
Cândido was running an outdated iOS version. Amnesty couldn’t determine the exact vulnerability used. But the infection server fingerprints matched known Intellexa infrastructure with high confidence.
💰 The Money — What Predator Costs
| Item | Price |
|---|---|
| Full Predator deployment (2021 proposal) | €13.6 million |
| Documented 2022 license | €8 million |
| Per zero-day exploit (RCE + sandbox bypass) | $100K–$300K each |
| Geographic restriction removal (extra countries) | Additional fee per country code |
| Number of zero-days burned since 2021 | 15+ |
Licenses are restricted to a single phone country code prefix. Want to spy in more countries? Pay more. This isn’t a product for criminals — it’s a product for governments with deep pockets and flexible ethics.
🌍 Where Predator Is Active — It's Not Just Angola
Google sent spyware threat notifications to “several hundred accounts” across:
- Angola — first forensic confirmation, infrastructure active since March 2023
- Pakistan — human rights lawyer targeted in Balochistan, summer 2025
- Kazakhstan — active threat notifications
- Egypt — active threat notifications
- Uzbekistan — active threat notifications
- Saudi Arabia — active threat notifications
- Tajikistan — active threat notifications
- Iraq — new evidence of deployment
Amnesty believes Cândido may be just one of many targets in Angola alone, based on the number of infection domains found. Multiple domains, plural operators, long-running campaigns.
🗣️ Reactions — Sanctions Didn't Work
Amnesty International: Published the forensic proof. Sent a letter to Intellexa on January 27, 2026. No response.
Biden administration (2024): Sanctioned Intellexa, founder Tal Dilian, and associate Sara Aleksandra Fayssal Hamou.
Trump administration (2025): Quietly delisted three Intellexa executives. Senate Democrats demanded answers.
Intellexa Leaks (Dec 2025): Amnesty and media partners revealed that Intellexa employees had remote access to customer systems — meaning the spyware vendor could see what governments were doing with the tool. No evident technical limitations on this access.
Greece (Feb 2026): Convictions in the “Predatorgate” scandal — rare accountability in the commercial spyware space.
The pattern: sanction, delist, rebrand, keep selling. Intellexa has restructured across jurisdictions so many times that Recorded Future published an entire report just mapping their corporate web.
📱 Angola's Political Context
This didn’t happen in a vacuum. Under President João Lourenço:
- Repression of peaceful protests is routine
- Excessive force, arbitrary arrests, and detentions are documented
- Enforced disappearances have been reported
- The Syndicate of Angolan Journalists organized a national protest in 2022 condemning attacks on press freedom — led by the very journalist who was later targeted
Cândido wasn’t some random target. He was the guy organizing resistance to exactly the kind of government that buys Predator licenses.
Cool. So governments are buying spyware that sanctions can’t stop and pointing it at journalists. Now What the Hell Do We Do? ( ͡ಠ ʖ̯ ͡ಠ)
🔍 Hustle #1: Mobile Forensics & Spyware Detection Consulting
The market for checking whether someone’s phone has been compromised barely exists outside of Amnesty and Citizen Lab. Journalists, activists, lawyers, and NGO workers in high-risk countries need someone to run the checks — and most don’t know how.
Learn Amnesty’s Mobile Verification Toolkit (MVT), get familiar with iOS sysdiagnose logs, and offer forensic analysis as a service. You don’t need to be a nation-state. You need a laptop, MVT, and the patience to read log files.
Example: A freelance security researcher in Nairobi, Kenya started offering phone audits to East African journalists after the Pegasus revelations. Using MVT and iVerify, she checks 3–5 devices per week at $200–$400 per audit. After partnering with a local press freedom org, she’s pulling $3K/month with zero marketing spend.
Timeline: 2–4 weeks to learn MVT and practice on your own devices. First paying clients within 6 weeks if you connect with press freedom organizations.
📝 Hustle #2: OPSEC Training for At-Risk Populations
Every journalist, activist, and human rights lawyer in the countries on that list needs operational security training. Most have never heard of Lockdown Mode. Most don’t restart their phones daily. Most click links from “students” asking about local politics.
Build a curriculum. Deliver it over Signal or in person. Charge NGOs and media organizations, not the individuals. Foundations like the Committee to Protect Journalists and Reporters Without Borders fund exactly this kind of work.
Example: A cybersecurity trainer in Accra, Ghana built a 2-day OPSEC workshop for West African journalists. Covers device hygiene, phishing recognition, and secure communication setup. Funded by a European press freedom foundation at €4,000 per workshop. Runs 2–3 per month across the region.
🛡️ Hustle #3: iOS/Android Hardening Guides as Paid Content
There’s a gap between “Apple released Lockdown Mode” and “anyone actually knows how to configure their phone properly.” Write device hardening guides — not the generic “use a strong password” stuff, but real guides covering Lockdown Mode, disabling iMessage link previews, restricting USB accessories, clearing browser state, and configuring automatic reboots.
Sell them on Gumroad or bundle them with consulting. Target: small newsrooms, NGOs, and law firms.
Example: A privacy researcher in Tbilisi, Georgia published an iOS hardening guide specifically for Caucasus-region journalists. Sold 800 copies at $15 on Gumroad in the first 3 months. Now maintains a subscription version ($5/month) that gets updated when new exploits drop. Monthly recurring: $2,100.
💼 Hustle #4: Spyware Infrastructure OSINT Research
Amnesty and Citizen Lab can’t do it all. The Predator infection domains Amnesty mapped are public. The fingerprinting techniques are documented. If you have OSINT skills, you can contribute to tracking new infrastructure deployments — and get paid for it.
Companies like Recorded Future, Lookout, and iVerify hire contract researchers. Threat intel reports on commercial spyware infrastructure get published (and funded) regularly.
Example: An OSINT analyst in Bucharest, Romania started mapping Predator-linked domains as a side project after reading the Amnesty reports. Submitted findings to Citizen Lab and published a blog post that got picked up by The Record. Got contracted by a threat intelligence firm for $5K/month part-time to continue the work.
🧠 Hustle #5: Secure Communication Setup-as-a-Service
Small newsrooms in Africa, South Asia, and Central Asia need to migrate off WhatsApp and set up proper secure comms. Signal deployment, encrypted email (ProtonMail/Tuta), secure file sharing, and device management. Most of them don’t have an IT person.
Offer remote setup packages: audit their current tools, migrate them to secure alternatives, and train the staff. Charge per-org, not per-person.
Example: A sysadmin in Kampala, Uganda started offering “digital safety packages” to small media houses after a local journalist’s phone was compromised. $500 per newsroom for full migration (Signal, ProtonMail, VPN setup, device hardening). Completed 12 organizations in 4 months, mostly through word-of-mouth and one CPJ referral.
🛠️ Follow-Up Actions
| Want To… | Do This |
|---|---|
| Learn mobile forensics |
Install Amnesty’s MVT and practice on your own device |
 Read the full Amnesty report |
Journalism Under Attack: Predator in Angola |
 Enable Lockdown Mode right now |
Settings → Privacy & Security → Lockdown Mode (iOS 16+) |
 Study the Intellexa Leaks |
Amnesty’s “To Catch a Predator” report |
| Map spyware infrastructure |
Start with Recorded Future’s Intellexa corporate web analysis |
 Connect with the community |
Join EFF’s Electronic Frontier Alliance or Access Now’s Digital Security Helpline |
Quick Hits
| Want To… | Do This |
|---|---|
| Check if your phone is compromised |
Run MVT — it’s free, open-source, and it’s what Amnesty actually uses |
| Block Predator-style one-click attacks |
Enable iOS Lockdown Mode. It disables most attack surfaces Predator uses |
 Stop being phishable on WhatsApp |
Don’t click links from strangers. Restart your phone daily. Use an up-to-date iOS version |
| Understand the spyware market |
Read the Intellexa Leaks — €13.6M per license, remote access to customer systems, 15+ zero-days burned |
| Support press freedom orgs doing this work |
Donate to Amnesty’s Security Lab, Citizen Lab, or Committee to Protect Journalists |
A reboot saved one journalist. Sanctions saved nobody. Keep your phone updated and your links unclicked.
!