Intellexa’s Predator spy ware used to hack iPhone of journalist in Angola, analysis says

A authorities buyer of sanctioned spy ware maker Intellexa hacked the cellphone of a outstanding journalist in Angola, in accordance to Amnesty Worldwide, the newest case of concentrating on somebody in civil society with highly effective phone-hacking software program.

The human rights group published a new report Tuesday analyzing a number of hacking makes an attempt towards native journalist and press freedom activist Teixeira Cândido, by which he was despatched a collection of malicious hyperlinks through WhatsApp throughout 2024. 

Cândido finally clicked on one and his iPhone was hacked with Intellexa’s spy ware, dubbed Predator, Amnesty discovered.

The brand new analysis exhibits once more that authorities prospects of commercial surveillance vendors are more and more utilizing spy ware to goal journalists, politicians, and different peculiar residents, together with critics. Researchers have beforehand discovered proof of Predator abuse in Egypt, Greece, and Vietnam, the place the authorities reportedly targeted U.S. officials by sending the spy ware through hyperlinks on X.  

Intellexa is certainly one of the most controversial spy ware makers of the previous few years, working from completely different jurisdictions to skirt export legal guidelines and utilizing an “opaque net of company entities” — as a U.S authorities official put it at the time — to cover its actions.

In 2024, round the identical time certainly one of Intellexa’s prospects was concentrating on Cândido with its spy ware, the outgoing Biden administration sanctioned the firm, in addition to its founder Tal Dilian and his enterprise associate Sara Aleksandra Fayssal Hamou. 

Earlier this yr, the Treasury lifted sanctions towards three different executives tied to Intellexa, a call that left Senate Democrats demanding answers from the Trump administration. 

Dilian did not reply to a request for remark.

Amnesty researchers wrote in the report that they linked the intrusions to Intellexa by analyzing forensic traces discovered on Cândido’s cellphone. Amnesty mentioned that Intellexa used an infection servers that had been beforehand linked to the firm’s spy ware infrastructure. 

A number of hours after clicking on the hyperlink that led to his cellphone hack, Cândido rebooted his cellphone, which wiped the spy ware from his gadget. Amnesty mentioned it wasn’t clear how the spy ware was able to hacking Cândido’s cellphone, as his cellphone was working an outdated model of iOS at the time.

The researchers discovered that Predator stayed hidden by impersonating legit iOS system processes to keep away from detection. 

Amnesty believes Cândido could also be simply certainly one of many targets in the nation, primarily based on their findings that they have been ready to discover a number of domains linked to the spy ware maker utilized in Angola. 

“The primary domains linked to Angola have been deployed as early as March 2023, indicating the begin of Predator testing or deployment in the nation,” wrote the Amnesty researchers, who added that they’d no proof to decide precisely who hacked Cândido. 

“It is not at present doable to conclusively determine the buyer of the Predator spy ware in the nation,” learn the report. 

Final yr, primarily based on leaks of inside paperwork, Amnesty and media organizations revealed that Intellexa workers had the ability to access customers’ systems remotely, probably giving the spy ware maker visibility into authorities surveillance operations. 

These leaks, like this report, exhibits that regardless of its controversies and sanctions, Intellexa has remained energetic lately.

“We’ve now seen confirmed abuses in Angola, Egypt, Pakistan, Greece, and past — and for each case we uncover, many extra abuses absolutely stay hidden,” mentioned Donncha Ó Cearbhaill, the head of the safety lab at Amnesty Worldwide.