In a disturbing new development for press freedom and digital privacy in Africa, a recent forensic investigation has confirmed that Predator spyware was used to target a prominent Angolan journalist in 2024. The findings, published by Amnesty International’s Security Lab, mark the first forensic confirmation of this intrusive surveillance technology being deployed against civil society in Angola — a country already grappling with restrictions on independent media and civic space.
A Personal Invasion of Privacy
The investigation centers on Teixeira Cândido, a respected journalist, jurist, and leading advocate for press freedom in Angola. Cândido, who previously served as Secretary-General of the Syndicate of Angolan Journalists, was the recipient of a series of seemingly innocuous WhatsApp messages between April and June 2024. These messages, sent from an unknown local number, gradually built rapport by posing as a group of students discussing social issues, before ultimately including links designed to infect his phone with Predator. One of those links was clicked on 4 May 2024, triggering a successful infection.
Reflecting on the experience, Cândido described feeling “naked knowing that I was the target of this invasion of my privacy,” explaining that he has since become deeply distrustful of digital communication and now limits his usage of personal devices.
What Is Predator and How Does It Work?
Predator is a highly invasive mobile spyware developed and sold by Intellexa, a private surveillance firm. Designed to be deployed by government clients, it grants operators near-total access to a target’s device. That includes:
- Access to encrypted messaging apps such as WhatsApp and Signal
- Interception of emails, contacts, photos, and call logs
- Location tracking and screenshot capture
- Activation of the microphone and camera without user knowledge
Unlike simpler malware, Predator is engineered to evade detection and leave minimal forensic traces — making independent verification of an attack exceptionally difficult. The forensic analysis carried out in Cândido’s case is therefore particularly significant, as it conclusively links the attack vectors back to known Predator infrastructure.
A Broader Pattern of Surveillance
Although Cândido was only successfully infected on one occasion, there were at least 11 further attempts to reinfect his device between May and June 2024. Many of these subsequent links went unopened and therefore failed to install the spyware, but the persistence of the attacks highlights the systematic nature of the campaign.
Technical research into the domain names used in these WhatsApp links suggests that Predator may have been active in Angola since at least early 2023. These domains share network fingerprints with Predator infection servers documented elsewhere, indicating a potentially wider campaign against journalists and other civic actors in the country.
Implications for Press Freedom and Human Rights
The targeting of a journalist with such sophisticated spyware represents more than a personal attack — it underscores a growing global threat to press freedom and civic participation. By enabling unfettered access to phones and communication tools, spyware like Predator can:
- Undermine journalists’ ability to protect their sources
- Chill freedom of expression and dissent
- Encourage self-censorship and fear
- Compromise sensitive reporting and advocacy work
Amnesty International emphasizes that these kinds of attacks violate not only privacy but fundamental human rights tied to freedom of association, expression, and peaceful assembly. The fact that Predator continues to be used despite public exposure, ongoing criminal probes, and sanctions against its developers highlights the urgent need for stricter global oversight of mercenary spyware.
Conclusion
The forensic confirmation of Predator spyware in Angola signals a troubling shift in how sophisticated surveillance tools are used against journalists. In environments where press freedom is already constrained, digital surveillance adds an invisible layer of intimidation and control. While the motives and operators behind the attack on Teixeira Cândido remain officially unidentified, the impact on press freedom is unmistakable — and raises urgent questions about accountability, regulation, and the future of independent journalism in the digital age.
