Angolan Journalist Targeted with Spyware, Highlighting Growing Threat to Press Freedom

Luanda, Angola – Angolan journalist and lawyer Teixeira Cândido is demanding accountability after discovering his phone was infected with Predator spyware, a commercially available tool capable of extracting an infected device’s microphone, camera, and data – including contacts, messages, photos, and videos – without the user’s knowledge. The incident, revealed by Amnesty International’s Security Lab, marks the first publicly known case of targeted spyware use against a journalist within Angola, a nation facing tightening restrictions on the press ahead of the 2027 elections.

Cândido, a prominent media figure and former head of the Syndicate of Angolan Journalists, described the feeling as profoundly violating. “I literally felt naked! It’s as if someone I don’t know had stripped me naked in public. It’s like taking a shower with people watching,” he told the Committee to Protect Journalists (CPJ) in an interview in Luanda. “I don’t know what kind of information they had access to. I don’t know to what extent they shared my intimate conversations.”

The attack occurred on World Press Freedom Day, May 3, 2024, when Cândido likely clicked on a malicious link sent via WhatsApp. The sender, posing as representatives of Angolan students interested in discussing socioeconomic development, used an Angolan phone number and a common Angolan name to appear legitimate, according to Amnesty International. The infection lasted less than 24 hours, resolving after a device restart, but the potential for data compromise remains a serious concern.

This case underscores a global trend of governments and entities utilizing sophisticated surveillance technology to suppress dissent and monitor journalists. Similar experiences have been reported by journalists worldwide, including Russian editor Galina Timchenko, who described a similar feeling of vulnerability after being targeted with Pegasus spyware.

Expanding Surveillance Infrastructure

Amnesty International, the University of Toronto’s Citizen Lab, and U.S.-based cybersecurity firm Recorded Future have previously documented the infrastructure for operating Predator in over a dozen countries, including Angola. The spyware is developed by the Intellexa Consortium, founded by former Israeli military officer Tal Dilian. Leaked documents from December 2025, dubbed “Intellexa Leaks,” suggest company staff may have access to data collected from targets.

While the identity of those who ordered the surveillance on Cândido remains unknown, the incident coincides with a concerning shift in Angola’s political landscape. Executive Director of Friends of Angola, Florindo Chivucute, argues that Angola has regressed from its 1992 transition to democracy, citing a wave of “draconian laws” introduced during President João Lourenço’s second term, beginning in 2022.

New Laws, Increased Restrictions

These laws include the 2024 National Security Law, granting broad powers to security organs to disrupt communications, and a controversial law on vandalism criminalizing the filming or photographing of law enforcement activities. Parliament is currently considering further legislation that would criminalize the sharing of “false information” and expand surveillance powers with limited oversight.

Cândido fears these proposed laws will exacerbate the climate of fear and intimidation already felt by journalists and civil society. He noted that prior to the spyware attack, the Syndicate of Angolan Journalists experienced repeated burglaries where only computers were stolen, raising suspicions about targeted data collection.

International Response and Accountability

The Angolan General Prosecutor’s Office stated it “always tries to act within the limits of the law and has no knowledge of such situations.” The presidency and Ministry of Interior offered similar responses, claiming no knowledge of spyware use.

The international community is increasingly scrutinizing the spyware industry. In 2023, the U.S. added Intellexa firms to an Entity List, restricting their access to U.S. businesses. Sanctions were imposed on Dilian and other Intellexa-linked individuals in 2024, though some were later lifted in December 2025, prompting concern from U.S. lawmakers who have requested a briefing from the Treasury and State Departments.

Legal avenues for redress are emerging. In January, a U.K. court awarded over $4 million in damages to a Saudi dissident targeted with Pegasus. Similar cases are ongoing in California and Greece.

Cândido hopes for accountability within Angola but stresses the need for international support to expose those responsible for surveillance abuses. “Surveillance ultimately threatens our professional activity. We must unite and create a large international network, even against states, if necessary, to raise awareness, because it must be possible to defend freedom,” he said. “Otherwise, one day we will wake up and there will be no more journalism!”

Image of WhatsApp messages sent to Teixeira Cândido containing malicious links. (Screenshot: Amnesty International’s Security Lab)

Image of President João Lourenço in Angola in 2024. (Photo: Reuters/Elizabeth Frantz)

Video of Greek journalist Thanasis Koukakis describing his phone being infected with spyware. (Screenshot: Birn Balkans/YouTube) (Replace with actual YouTube link if available)