A mobile phone used by prominent Angolan journalist Teixeira Candido was briefly infected with Predator spyware in May 2024, according to a report published Tuesday by Amnesty International.
Candido, who was serving as head of the Syndicate of Angolan Journalists at the time, was targeted through a series of WhatsApp messages that began in April 2024, the report said. Amnesty’s investigation found that he clicked on a malicious link on May 4, triggering the installation of Predator, a powerful surveillance tool developed by spyware vendor Intellexa.
Once activated, the spyware gave the attacker full access to Candido’s phone, including its contents and communications, Amnesty said. The organization described the case as the first confirmed use of Predator spyware in Angola, though it did not attribute the operation to any specific government or client.
Candido told Reuters that the messages appeared to come from someone he did not know, who claimed to be part of a student group seeking his opinion on a project. He said he remains uncertain about what information may have been extracted from his device during the breach.
“I feel exposed, as if I were taking a shower with the bathroom door wide open,” Candido said in an email to Reuters ahead of the report’s publication.
Intellexa’s spyware products have been linked to multiple cases of alleged surveillance abuse in recent years, drawing scrutiny from researchers and governments. In March 2024, the United States imposed sanctions on seven individuals associated with the Intellexa Consortium, describing it as a network of decentralized companies that built and sold highly intrusive spyware used to target journalists, government officials, opposition figures, and policy experts.
In December 2025, the Trump administration removed three Intellexa executives from the sanctions list. At the time, a U.S. official told Reuters the individuals had taken steps to distance themselves from the Intellexa Consortium.
A lawyer linked to Intellexa did not immediately respond to a request for comment on Tuesday.