Intellexa's Predator Spyware Hacked an Angolan Journalist via WhatsApp — Despite US Sanctions

Jenna
Wed, 01 Apr 2026 14:42:00 +0000

Intellexa’s Predator Spyware Hacked an Angolan Journalist via WhatsApp — Despite US Sanctions

A sanctioned spyware vendor keeps selling. A journalist clicked one link. Amnesty found everything.

Intellexa’s Predator spyware — sanctioned by the US in 2023 — was used to hack Angolan journalist Teixeira Cândido’s iPhone in May 2024. The attacker posed as a student on WhatsApp for weeks before sending the kill link. License cost: €13.6 million per deployment.

Amnesty International’s Security Lab published the forensic proof in February 2026. It’s the first confirmed Predator case in Angola, but the infrastructure was active there since March 2023. The sanctions did nothing. The Trump administration even delisted three Intellexa executives in December. This is the commercial surveillance industry working exactly as designed.

🧩 Dumb Mode Dictionary (click for more details) 📖 The Backstory — Who Got Hit and How (click for more details) ⚙️ Under the Hood — Predator's Technical Stack (click for more details) 💰 The Money — What Predator Costs (click for more details) 🌍 Where Predator Is Active — It's Not Just Angola (click for more details) 🗣️ Reactions — Sanctions Didn't Work (click for more details) 📱 Angola's Political Context (click for more details)

Cool. So governments are buying spyware that sanctions can’t stop and pointing it at journalists. Now What the Hell Do We Do? ( ͡ಠ ʖ̯ ͡ಠ)

🔍 Hustle #1: Mobile Forensics & Spyware Detection Consulting (click for more details) 📝 Hustle #2: OPSEC Training for At-Risk Populations (click for more details) 🛡️ Hustle #3: iOS/Android Hardening Guides as Paid Content (click for more details) 💼 Hustle #4: Spyware Infrastructure OSINT Research (click for more details) 🧠 Hustle #5: Secure Communication Setup-as-a-Service (click for more details) 🛠️ Follow-Up Actions (click for more details)

Quick Hits

Want To… | Do This
Check if your phone is compromised | Run MVT — it’s free, open-source, and it’s what Amnesty actually uses
Block Predator-style one-click attacks | Enable iOS Lockdown Mode. It disables most attack surfaces Predator uses
Stop being phishable on WhatsApp | Don’t click links from strangers. Restart your phone daily. Use an up-to-date iOS version
Understand the spyware market | Read the Intellexa Leaks — €13.6M per license, remote access to customer systems, 15+ zero-days burned
Support press freedom orgs doing this work | Donate to Amnesty’s Security Lab, Citizen Lab, or Committee to Protect Journalists

A reboot saved one journalist. Sanctions saved nobody. Keep your phone updated and your links unclicked.

Read full topic