Angolan Journalist Targeted with Predator Spyware, Raising Press Freedom Concerns
Luanda, Angola – A prominent Angolan journalist, Teixeira Cândido, was targeted with Predator spyware in 2024, marking the first confirmed instance of its use in the country, according to Amnesty International [1]. The attack underscores growing concerns about surveillance and restrictions on press freedom in Angola.
What is Predator Spyware?
Predator is a highly invasive mobile phone spyware developed and sold by Intellexa, a mercenary spyware company [1]. It is designed for use by governments in surveillance operations, granting access to a device’s microphone, camera, data, contacts, messages, photos, and videos without the user’s knowledge [2], [1].
The Targeting of Teixeira Cândido
Teixeira Cândido, a journalist, lawyer, and former Secretary General of the Syndicate of Angolan Journalists (SJA), received a series of WhatsApp messages from an unknown Angolan number between April and June 2024 [1]. The sender, posing as a student interested in Angola’s social and economic affairs, sent malicious links designed to infect Cândido’s iPhone with Predator spyware [1], [2].
Forensic analysis by Amnesty International’s Security Lab confirmed that at least one of these links successfully infected Cândido’s phone on May 4, 2024 [1]. The spyware was removed when the phone was restarted later that day, but the incident has left Cândido deeply concerned about his privacy and security.
“I feel naked knowing that I was the target of this invasion of my privacy. I don’t know what they have in my possession about my life… Now I only do and say what is essential. I don’t trust my devices,” Cândido stated [2], [1].
Broader Implications and Ongoing Concerns
This case emerges from a broader investigation into surveillance threats in Angola throughout 2025, initially conducted by Friends of Angola and Front Line Defenders [1]. The 2024 attack is among the most recent confirmed Predator cases, alongside a 2025 attack on a human rights lawyer in Pakistan [1], indicating that Intellexa’s spyware system remained operational until 2025.
While Amnesty International cannot currently attribute the attacks to specific government customers, the incident highlights the risks faced by journalists and activists in Angola, particularly as the country approaches elections in August 2027 [2]. The attack occurs within a tightening authoritarian environment marked by repression of protests and abuses in detention.
Amnesty International sent a letter to Intellexa on January 27, 2026, seeking information about the company’s human rights due diligence processes but has yet to receive a response [1].
Reuters too reported on the targeting of Teixeira Candido with Predator spyware [4], [3].