Angolan Journalist Targeted by Predator Spyware
Amnesty International identified Predator spyware, developed by Intellexa, targeting Teixeira Cândido, a prominent Angolan journalist and former general secretary of the country's journalist union, through WhatsApp messages in May 2024. The infection lasted less than a day and reportedly represents the first confirmed use of Predator in Angola, part of a broader surveillance campaign in the African country.
What happened
Teixeira Cândido, a known Angolan journalist and former general secretary of Angola's journalist union, received messages via WhatsApp on his iPhone in May 2024 from an unknown sender using an Angolan phone number, claiming to represent a group of young students.
The sender initially sent messages without links to build trust, then began sending multiple messages with links to malicious software disguised as news articles. The phone infection lasted less than one day and ended when Cândido restarted his device on the evening of 4 May 2024.
Amnesty International's security laboratory identified the malware as Predator, spyware developed and distributed by Intellexa. Amnesty International stated it could not attribute the attack to any specific government, but noted that new laws in Angola in recent years have made the media and protest framework much more restrictive.
Reported impact
Cândido stated: 'After learning I became a target of invasion of my private life, I feel naked. I don't know what information they have at their disposal about my life. Now I do and say only what is necessary. I don't trust my devices. I exchange correspondence, but I don't deal with personal matters through my devices. I feel very limited.'
Since 2022, Cândido has faced multiple attacks and intimidation, including unexplained break-ins at his office.
Index analysis
According to testimony in an ongoing trial in Greece, former Intellexa employee Panagiotis Koutsios admitted the company conducted sales presentations to state bodies in Africa, including Kenya. Predator has been identified in Sudan and Egypt.
Amnesty International assessed this attack was part of a broader surveillance campaign using spyware in the African country. This is the first confirmed case of Predator use in Angola.
Governance controls
Cândido has filed a complaint with Angola's Public Prosecutor seeking protection against the spyware. Intellexa did not respond when asked for comment on the case.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.