Africa-Press – Liberia. An Angolan journalist and press freedom advocate was targeted with sophisticated “Predator” spyware in what Amnesty International describes as a calculated one-click cyberattack that unfolded on May 3, 2024 — ironically, World Press Freedom Day.
According to findings by Amnesty International, forensic traces show that journalist and lawyer Cândido received a malicious link via WhatsApp on May 3 and likely clicked on it. The action triggered the installation of Predator spyware on his mobile phone the following day. The infection reportedly lasted less than 24 hours and was removed after he restarted his device.
Investigators say the attacker continued sending additional malicious links in the weeks that followed, but those attempts did not result in further infections — likely because the journalist did not engage with them.
A Carefully Crafted Trap
“This was a typical one-click attack,” said Carolina Rocha da Silva, Operations Manager at Amnesty International’s Security Lab, which has tracked the use of Predator spyware globally. “The sender was using an Angolan phone number, a traditional Angolan name, and had a story, a motive for reaching out.”
The WhatsApp message reportedly came from someone claiming to represent Angolan students seeking to discuss socioeconomic development — a pitch tailored to Cândido’s public profile.
According to the Committee to Protect Journalists, Amnesty investigated in collaboration with the human rights groups Friends of Angola and Front Line Defenders. However, the investigation did not determine who ordered or authorized the surveillance.
The Spyware Network
Predator spyware was developed by the Intellexa Consortium, an international network of surveillance companies founded by former Israeli military officer Tal Dilian.
The so-called “Intellexa Leaks” published in December 2025 suggest that company staff may have had access to parts of clients’ Predator systems, including the ability to view data harvested from targeted devices.
Dilian did not respond to requests for comment. In response to the leaks investigation, his lawyer stated that companies seeking export licenses for active cyber tools must assume responsibility before selling such systems, while governments bear responsibility for their use after purchase.
Democracy Under Strain
Spyware attacks pose a profound threat to press freedom, undermining journalists’ safety and their ability to protect sources.
“It’s really a matter of personal safety. You don’t know if you’re being watched, if you’re being followed,” Cândido said. “Despite all the security measures you can take, there’s always a feeling of insecurity that doesn’t go away.”
Cândido, who headed the Syndicate of Angolan Journalists until 2024 and hosts a program on the privately owned Radio Essencial broadcaster, said his concerns about digital surveillance intensified around Angola’s 2022 national elections, following repeated burglaries at the union’s headquarters.
“They only stole computers and weren’t interested in anything else,” he said. “The fact that they took our computers made us aware of the interest in our documents and contacts.”
He suspects the spyware attack may be linked to his union leadership and outspoken advocacy for press freedom.
‘Draconian Laws’ and Expanding Surveillance
Angola transitioned from communism to multiparty democracy in 1992. But according to Florindo Chivucute, Executive Director of Friends of Angola, recent legal developments under President João Lourenço’s second term have rolled back democratic gains.
In 2024, Angola enacted a National Security Law granting authorities expanded powers to disrupt telecommunications and internet systems under “exceptional circumstances.” A vandalism law passed the same year criminalized filming or publishing certain information related to public security, although portions have since been ruled unconstitutional.
Now in 2026, lawmakers are advancing two additional draft bills: one criminalizing the dissemination of “false information” and another expanding cybersecurity surveillance powers. The proposed cybersecurity legislation would establish a National Cybersecurity Centre with regulatory and sanctioning authority, including the ability to demand information from communications operators without a court order.
Cândido warned that such measures could create a climate of fear among journalists and citizens.
“Only judges can authorize wiretaps — and only when there is suspicion that the person has committed a crime,” he said. “I am a journalist, I am a lawyer. I don’t know to what extent there could be an order of this kind.”
Government Response
Responding to inquiries, Alvaro João, spokesperson for the General Prosecutor’s Office, said the office acts “within the limits of the law” and had no knowledge of such surveillance activities.
Luis Fernando, spokesperson for the presidency, also said he was unaware of any proof of spyware use. Meanwhile, Interior Ministry spokesperson Wilson dos Santos said he would comment once further details were made public.
Accountability Beyond Borders
Legal battles over spyware abuses are mounting globally.
In January, a U.K. High Court ordered Saudi Arabia to pay more than US$4 million in damages to dissident Ghanem al-Masarir, whose phone was targeted with Pegasus spyware. In 2025, a California judge ordered Israel-based NSO Group to stop targeting WhatsApp users and to pay damages, while a separate trial is ongoing in Greece over the targeting of journalist Thanasis Koukakis with Predator.
In 2023, the United States placed Intellexa firms on its Entity List for activities deemed contrary to U.S. national security interests. In 2024, Washington sanctioned Dilian and other Intellexa-linked individuals. However, in December 2025, three of those individuals were removed from the sanctions list — prompting concern from U.S. lawmakers.
On February 13, five members of Congress wrote to the Treasury and State Departments seeking justification for the removals.
The U.S. Treasury Department has not publicly commented on the matter.
“Otherwise, There Will Be No Journalism”
For Cândido, the issue transcends personal security.
“Surveillance ultimately threatens our professional activity,” he said. “We must unite and create a large international network, even against states, if necessary, to raise awareness, because it must be possible to defend freedom.”
“Otherwise, one day we will wake up, and there will be no more journalism.”
For More News And Analysis About Liberia Follow Africa-Press
