Amnesty Confirms Predator Spyware Hacked Angolan Journalist's iPhone

Predator Strikes in Angola

Amnesty International has revealed that Predator spyware, developed by sanctioned surveillance consortium Intellexa, was used to compromise the mobile phone of prominent Angolan journalist and press freedom advocate Teixeira Candido. The forensic investigation by Amnesty's Security Lab marks the first confirmed case of the invasive surveillance tool being deployed in Angola.

How the Attack Unfolded

Candido, a lawyer and former secretary-general of the Syndicate of Angolan Journalists, received multiple malicious links via WhatsApp over several weeks beginning in May twenty twenty four. The first message arrived on World Press Freedom Day, with the attacker posing as a representative of Angolan students interested in discussing socioeconomic development. After Candido clicked a link the following day, Predator installed on his iPhone, granting the operator total access to his microphone, camera, encrypted messages, contacts, photos, and location data.

The infection lasted less than twenty four hours and was inadvertently removed when Candido restarted his device. The attacker sent at least eleven additional malicious links through mid-June twenty twenty four, but none resulted in further infections.

A Wider Campaign

Amnesty researchers believe Candido may be just one of multiple targets in Angola. Infrastructure analysis revealed Predator-linked domains were activated in the country as early as March twenty twenty three, suggesting spyware testing or deployment began well before the attack on the journalist. Recorded Future's Insikt Group had previously identified Angola among countries with Predator operator activity.

Sanctions and Political Context

Intellexa, founded by former Israeli intelligence officer Tal Dilian, was sanctioned by the United States Treasury in twenty twenty four for distributing surveillance technology used against American officials and journalists. However, in December twenty twenty five, the Trump administration lifted sanctions on three Intellexa-linked executives, a move that drew criticism from Senate Democrats and press freedom advocates.

Press Freedom Under Threat

The attack comes amid deteriorating conditions for journalists in Angola, where the Committee to Protect Journalists has documented prosecutions on criminal defamation charges, broadcast suspensions, and harassment. Angolan officials denied knowledge of the spyware attack, while Candido has called for international support to identify those responsible.