Angolan journalist's iPhone infiltrated by Predator surveillance tool - AI News Today Recency

# Angolan Journalist's iPhone Infiltrated by Predator Surveillance Tool

A prominent Angolan journalist has become the latest victim of Predator spyware, a sophisticated surveillance tool deployed by government-backed operatives to target civil society figures. According to Amnesty International's investigation released this week, journalist and press freedom activist Teixeira Cândido fell victim to the invasive malware after clicking a malicious link sent via WhatsApp during 2024[1]. The incident underscores the escalating threat that commercial surveillance vendors pose to journalists, activists, and political opponents worldwide.

How the Predator Spyware Attack Unfolded

Amnesty International's forensic analysis revealed that Cândido received multiple malicious links via WhatsApp throughout 2024, with attackers attempting to compromise his device[1]. The journalist eventually clicked on one of these links, which successfully infected his iPhone with Predator—a mercenary spyware developed and distributed by Intellexa, an Israeli-owned surveillance consortium[3].

The attack was particularly sophisticated because the spyware remained hidden by impersonating legitimate iOS system processes, making detection extremely difficult[1]. Remarkably, Cândido's iPhone was running an outdated version of iOS at the time, yet the spyware still managed to infiltrate the device[1]. Fortunately, Cândido rebooted his phone several hours after clicking the malicious link, which wiped the spyware from his device before it could cause extensive damage[1].

Predator's Capabilities and Global Reach

Predator is a sophisticated mercenary spyware designed to target both Android and iPhone devices, with documented activity dating back to at least 2019[3]. Once installed on a device, the tool provides complete access to a victim's microphone, camera, contacts, messages, photos, videos, and all other stored or transmitted data[3]. The spyware's modular, Python-based architecture allows operators to add capabilities remotely without requiring a new exploit, making it exceptionally difficult to detect and remove[3].

Although officially marketed for counterterrorism and law enforcement purposes, investigations have consistently revealed that Predator is being abused to target journalists, activists, and politicians[3]. The spyware has been identified in operations across more than a dozen countries, including Angola, Armenia, Botswana, Egypt, Indonesia, Kazakhstan, Mongolia, Mozambique, Oman, the Philippines, Saudi Arabia, and Trinidad and Tobago[4][5]. Notably, over half of Predator's identified customers are located in Africa, making the continent a primary focus for surveillance abuse[4].

Angola's Emerging Surveillance Infrastructure

While Amnesty International could not conclusively identify which government customer deployed Predator against Cândido, the organization found evidence suggesting Angola has become an active testing and deployment ground for the spyware[1]. The first domains linked to Angola were deployed as early as March 2023, indicating that Predator testing or operations began in the country more than a year before Cândido's attack[1]. Amnesty's discovery of multiple domains linked to the spyware maker in Angola suggests that Cândido may be just one of many surveillance targets in the country[1].

This pattern aligns with broader findings about Predator's infrastructure. Researchers at Recorded Future's Insikt Group identified a new multi-tiered delivery network consisting of delivery servers, upstream servers, and supporting infrastructure, suggesting that spyware operators have continued selling their product despite previous exposure[5]. The fact that Predator operators have not significantly altered their infrastructure indicates their confidence in continuing operations despite international scrutiny[5].

Broader Implications for Press Freedom and Civil Society

The targeting of Cândido represents part of a troubling global trend in which government customers of commercial surveillance vendors increasingly abuse spyware to silence critics and suppress dissent[1]. Previous cases of Predator abuse have been documented in Egypt, Greece, and Vietnam, where governments have used the tool against journalists, opposition politicians, and civil society activists[1][2]. In one notable case, Vietnamese authorities allegedly used Predator to target U.S. officials by sending malicious links via X[1].

The abuse of Predator also raises serious questions about vendor accountability. Last year, leaked internal documents revealed that Intellexa employees had the ability to remotely access customers' systems, potentially giving the spyware maker visibility into government surveillance operations and raising concerns about the vendor's complicity in human rights abuses[1][2]. This level of access suggests that Intellexa maintains significant control over how its product is deployed and potentially could intervene to prevent misuse—but has not done so.

Frequently Asked Questions

What is Predator spyware and how does it work?

Predator is a sophisticated mercenary spyware developed and distributed by Intellexa that targets both Android and iPhone devices[3]. Once installed, it provides complete access to a device's microphone, camera, contacts, messages, photos, videos, and all other data[3]. The spyware can be installed through either "one-click" or "zero-click" attacks and is designed to leave minimal traces on infected devices, making detection extremely difficult[5]. Its modular architecture allows operators to add new capabilities remotely without re-exploiting the device[3].

How did the attacker infect Cândido's iPhone?

The attacker sent Cândido multiple malicious links via WhatsApp during 2024[1]. When Cândido eventually clicked on one of these links, his iPhone was infected with Predator[1]. The spyware remained hidden by impersonating legitimate iOS system processes to avoid detection[1]. Cândido was able to remove the spyware by rebooting his phone several hours after the infection[1].

Which countries have identified Predator spyware operations?

Predator operators have been identified in over a dozen countries, including Angola, Armenia, Botswana, the Democratic Republic of the Congo, Egypt, Indonesia, Kazakhstan, Mongolia, Mozambique, Oman, the Philippines, Saudi Arabia, and Trinidad and Tobago[4][5]. Over half of Predator's identified customers are located in Africa[4].

Who is responsible for selling and distributing Predator?

Predator was initially created by Cytrox and is now managed and distributed through a network of Intellexa-linked companies[3]. Intellexa is an Israeli-owned surveillance consortium that markets Predator as a tool for counterterrorism and law enforcement use[6]. However, investigations have revealed that Intellexa employees have the ability to remotely access customers' systems, potentially allowing the vendor visibility into surveillance operations[1][2].

Why is Predator difficult to detect on infected devices?

Predator is designed to leave minimal traces on compromised devices, complicating external investigations into its misuse[3]. The spyware hides by impersonating legitimate iOS system processes, making it appear as if normal system operations are occurring[1]. Additionally, recent iPhone operating system updates have made detection increasingly difficult, and many victims lack awareness or support to identify infections[3].

What are the implications of Predator abuse for journalists and activists?

The targeting of journalists like Cândido demonstrates that government customers of commercial surveillance vendors are increasingly using spyware to silence critics and suppress civil society[1]. Although Predator is officially marketed for law enforcement purposes, it is consistently abused to target journalists, activists, and politicians[3]. This abuse poses a severe threat to press freedom, democratic discourse, and human rights globally, particularly in countries where government oversight is limited.