Amnesty: Prominent Angolan Journalist Targeted by Spyware Intellexa

Amnesty International has documented what it describes as the first confirmed Predator spyware infection in Angola, identifying a targeted operation against journalist and media union leader Teixeira Candido.

The organization said a phone used by Candido was compromised for a brief period in May 2024, following a series of WhatsApp messages that began in April 2024.

According to Amnesty’s Security Lab, Candido clicked a malicious link on May 4, 2024, triggering the Predator infection.

The spyware, developed and marketed by Intellexa, an infamous predator software developed by Israeli owned spyware company, is capable of granting operators full access to a device’s data, including communications and stored files.

Infection Mechanism And Access

Amnesty said the attack vector relied on social engineering through WhatsApp. Candido was serving as head of the Syndicate of Angolan Journalists at the time.

The rights group did not attribute the operation to a specific government client but noted Predator’s established role in previous global surveillance controversies.

Intellexa’s spyware “has been linked to a string of privacy abuses in recent years,” Amnesty said, citing findings from researchers and the US government.

Deceptive Outreach Tactics

Candido said he was contacted by an unknown individual claiming to be part of a student group seeking his opinion on a project. Amnesty noted that such impersonation tactics remain a common technique in advanced spyware campaigns.

Candido said he does not know what information, if any, was extracted from his phone.

Election-Era Concerns

The Committee to Protect Journalists (CPJ) said the Angola case adds to broader concerns over digital surveillance and political pressure. CPJ stated: “The use of Predator spyware against prominent Angolan journalist and lawyer Teixeira Candido adds to a repressive pattern ahead of the country’s elections in 2027.”

The group said the incident enhances “global concerns over surveillance tech sold by Intellexa and other companies.”

Intellexa And Global Scrutiny

Predator spyware has drawn sustained international scrutiny. In March 2024, the US government sanctioned seven individuals associated with the Intellexa Consortium. A Treasury Department notice described the business as “a complex international web of decentralized companies” commercializing “highly invasive spyware products.”

On December 30, 2025, the Trump administration removed three Intellexa executives from its sanctions list. A US official told Reuters the individuals had “demonstrated measures to separate themselves from the Intellexa Consortium.”

Leaks And Abuse Allegations

Amnesty’s Senior Director for Research Erika Guevara Rosas had said in December 2025 that leaked Intellexa files exposed internal operations linked to human rights violations. The investigation found that “Intellexa could remotely access government customer systems,” while Predator spyware was “confirmed in abuses in Greece and Egypt.” Amnesty’s Security Lab also uncovered “evidence of Predator spyware actively operating in Pakistan.”

She said the leaks revealed “a business model built on exploiting mobile vulnerabilities.”

The revelations echo wider concerns about the expanding reach of commercial surveillance technologies. A Haaretz investigation recently reported that Israeli cyber firms are developing tools to transform vehicles into intelligence-gathering platforms - a practice described as CARINT. According to the investigation, such systems can track cars in real time, integrate SIM, GPS, and camera data, and in certain cases penetrate multimedia systems to access onboard microphones and cameras.

Personal Impact And Reaction

Candido described the psychological consequences of the breach in comments to Reuters. “I feel exposed, as if I were taking a shower with the bathroom door wide open,” he said. In additional remarks, he stated: “I feel naked knowing that I was the target of this invasion of my privacy.”

He said he no longer trusts his digital devices for sensitive matters, adding that he now limits communications to “what is essential.”

Candido’s case and parallel reporting on emerging surveillance capabilities underscore a broader shift in the commercial spyware landscape. As digital intrusion tools evolve beyond smartphones to encompass vehicles and other connected systems, regulators and rights groups warn that oversight mechanisms are struggling to keep pace with technologies increasingly marketed under the banner of security and intelligence.