Luanda, Angola – A prominent Angolan journalist has been targeted with the highly invasive Predator spyware, marking the first forensically confirmed case of its use within the country. Teixeira Cândido, a vocal critic of government restrictions on journalism and former Secretary General of the Syndicate of Angolan Journalists (SJA), was subjected to the attack in 2024, according to a new investigation by Amnesty International’s Security Lab.
Predator, developed and sold by the mercenary spyware company Intellexa, allows for the complete extraction of data from a targeted mobile device, including encrypted messages, audio recordings, location data and even activation of the device’s microphone. The spyware’s use has been documented in multiple countries over the past five years, raising concerns about its role in enabling human rights abuses.
“I feel naked knowing that I was the target of this invasion of my privacy. I don’t know what they have in their possession about my life,” Cândido stated, describing the impact of the surveillance. “Now I only do and say what is essential. I don’t trust my devices. I exchange correspondence, but I don’t deal with intimate matters on my devices. I feel very limited.”
The attack on Cândido emerged from a broader investigation into surveillance threats in Angola throughout 2025, initially conducted by Friends of Angola and Front Line Defenders. Amnesty International’s Security Lab confirmed the spyware infection through forensic analysis of Cândido’s phone, identifying network communications linked to Intellexa’s Predator system on .
The method of attack involved a series of WhatsApp messages sent to Cândido’s iPhone from an unknown Angolan number between and . The sender, posing as a student interested in social and economic affairs, lured Cândido into clicking malicious links disguised as news articles and legitimate websites. The spyware was successfully installed when Cândido opened one of these links on .
While the infection was reportedly removed when Cândido restarted his phone later that day, the attacker continued sending further malicious links until , though these attempts appear to have been unsuccessful.
This case is particularly concerning given the tightening authoritarian environment in Angola under President João Lourenço’s administration. Amnesty International has documented a pattern of repression, including the suppression of peaceful protests, arbitrary arrests and detentions, abuses in detention, and enforced disappearances. The targeting of a journalist critical of these trends raises serious questions about the government’s commitment to freedom of expression.
The use of Predator spyware in Angola also adds to a growing global pattern of surveillance targeting journalists, human rights defenders, and political opponents. A recent investigation by Amnesty International and others revealed further abuses linked to the spyware, including a attack on a human rights lawyer in Pakistan’s Balochistan province. This demonstrates that Intellexa and its Predator system remained operational well into , despite facing public exposure, criminal investigations, and sanctions.
“Forensic analysis conducted by Amnesty International’s Security Lab confirmed with high confidence that the infection links are tied to Intellexa’s Predator spyware and resulted in at least one successful infection of Teixeira Cândido’s phone,” said Carolina Rocha da Silva, Operations Manager at Amnesty International’s Security Lab.
Amnesty International has sent a letter to Intellexa requesting information about the company’s human rights due diligence processes, but has yet to receive a response. The organization emphasizes that the commercial sale and use of surveillance technologies without adequate safeguards continues to enable human rights abuses worldwide.
Cândido has faced other forms of intimidation, including unexplained break-ins at his office, since . This latest revelation of spyware use underscores the escalating threats faced by journalists and activists in Angola, and the urgent need for greater protection of fundamental freedoms.
The case highlights the broader implications of the spyware trade, with concerns growing over the lack of regulation and accountability surrounding these powerful surveillance tools. The continued operation of companies like Intellexa, despite international scrutiny and sanctions, raises questions about the effectiveness of current measures to prevent human rights abuses enabled by surveillance technology.
