Predator Spyware Hacked an Angolan Journalist's Phone on World Press Freedom Day

The Attack

On May 3, 2024, World Press Freedom Day, Teixeira Candido received a WhatsApp message from an unknown Angolan phone number. The sender, using a common local name, claimed to be a student interested in discussing socioeconomic development. Over the course of the conversation, they built rapport before sending a link disguised as a news article.

Candido clicked the link on May 4. Within moments, Predator spyware had installed itself on his iPhone. For less than 24 hours, until his phone restarted and cleared the infection, whoever was on the other end had access to everything: his encrypted messages, microphone, camera, contacts, photos, location, and passwords.

The attacker did not give up after the restart. Between May 4 and June 16, 2024, they sent 11 additional malicious links, all of which failed to reinfect the device.

Who Is Teixeira Candido

Candido is not a random target. He is one of Angola's most prominent journalists, a lawyer, a radio host at Radio Essencial, and the former Secretary General of the Syndicate of Angolan Journalists. He has been a vocal critic of the Angolan government and a persistent advocate for press freedom in a country where independent journalism carries real physical risk.

Since 2022, Candido has faced multiple physical attacks and break ins at his office. The spyware infection adds a digital dimension to a pattern of harassment that was already well documented.

"I Literally Felt Naked"

When Amnesty International informed Candido of the forensic findings, his reaction was visceral: "I literally felt naked. It's as if someone I don't know had stripped me naked in public."

"I don't know what kind of information they had access to. I don't know to what extent they shared my intimate conversations," he said. "Now I only do and say what is essential. I don't trust my devices. I exchange correspondence, but I don't deal with intimate matters on my devices. I feel very limited."

The chilling effect is the point. Surveillance does not need to be permanent to work. A single confirmed infection changes how a journalist communicates, who they contact, and what stories they pursue. As Candido put it: "Surveillance ultimately threatens our professional activity. One day we will wake up and there will be no more journalism."

What Is Predator

Predator is developed and sold by the Intellexa consortium, a mercenary spyware company founded by Tal Dilian, a former Israeli military intelligence officer. Unlike its better known competitor Pegasus by NSO Group, Predator typically requires the target to click a link rather than using fully zero click exploits.

Once installed, Predator can access virtually everything on the device: encrypted messaging apps, emails, call logs, screenshots, passwords, contacts, location data, and the microphone and camera. It is designed to leave no traces, though Amnesty International's Security Lab has developed forensic methods to detect infection artifacts in network communications.

The U.S. government added Intellexa to its Entity List in 2023 and sanctioned Tal Dilian and associates in 2024. However, three sanctioned individuals were quietly removed from the list in December 2025, raising Congressional concern about enforcement commitment.

Angola's Crackdown on Press Freedom

The spyware attack fits into a broader pattern of authoritarian tightening under President Joao Lourenco's administration. Recent legislation has systematically narrowed the space for independent journalism:

• A 2024 National Security Law grants security agencies power to disrupt telecommunications and internet systems under "exceptional circumstances"
• A 2024 Vandalism Law criminalized filming or photographing security personnel and public services, though parts were later declared unconstitutional
• Two draft laws pending in 2026 would criminalize "false information" and expand cybersecurity surveillance with limited judicial oversight

Amnesty International has documented systematic repression of peaceful protests, excessive force, arbitrary arrests, and enforced disappearances. The spyware deployment adds a sophisticated digital tool to an already extensive toolkit of repression.

A Global Pattern

Angola is now added to a growing list of countries where commercial spyware has been forensically confirmed against journalists. Ethiopia, Greece, Hungary, India, Mexico, Poland, Saudi Arabia, the UAE, and others have all been implicated in deploying Predator or Pegasus against press and civil society.

The pattern repeats because the market incentives have not changed. Companies like Intellexa sell to governments with documented human rights abuses, and the consequences remain minimal. As long as the spyware industry operates with effective impunity, journalists like Candido will continue to be targets.

The question Candido asked is the right one: "First and foremost, we must seek to find out who the entities are that have acquired these spyware tools." With Angola's elections approaching in August 2027, the stakes for press freedom are only growing. The tools used to silence journalists today will shape what voters know tomorrow.