Intellexa Predator spyware targets multiple countries with surveillance access
A joint investigation found that Intellexa Consortium's Predator spyware has been used to target several hundred accounts in multiple countries including Pakistan, Kazakhstan, Egypt and others, with evidence showing the system accesses encrypted messages, passwords and audio recordings. Researchers discovered that Intellexa retained the ability to remotely access customer surveillance systems even after deployment, reportedly including those at government premises.
What happened
A joint investigation by Amnesty International, Google Threat Intelligence, The Citizen Lab, and researchers from Inside Story, Haaretz and WAV Research Collective found that Intellexa Consortium's Predator spyware has been used to target hundreds of accounts across multiple countries. The spyware works by sending malicious links that, when clicked, infect targeted devices and provide access to encrypted instant messages on Signal and WhatsApp, stored passwords, emails, contact lists, call logs, microphones, and audio recordings.
The investigation, termed the 'Intellexa Leaks,' revealed that clients in Pakistan and other countries are using Predator to spy on people, including a human rights lawyer. Evidence from leaked training videos showed that Intellexa retained the capability to remotely access Predator customer systems even after deployment, including those physically located at government premises.
Reported impact
According to the investigation, spyware targets affected people across Pakistan, Kazakhstan, Angola, Egypt, Uzbekistan, Saudi Arabia, and Tajikistan. Several hundred accounts have been targeted, with specific reported cases including surveillance of a human rights lawyer in Pakistan.
Index analysis
Intellexa is a consortium led by a former senior Israeli intelligence official and has been sanctioned by the US government. The investigation provides documentation of Intellexa's internal operations and the actual deployment and use of Predator against targets in multiple countries.
Governance controls
When researchers notified Intellexa on 26 November 2025 about the findings, including questions about post-deployment access to customer systems and technical limitations, a legal representative for founder Tal Dilian responded on 3 December stating he had 'not committed any crime nor operated any cyber system in Greece or anywhere else,' without addressing the specific allegations.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.