Teixeira Cândido, a prominent Angolan journalist, press freedom activist, and former Secretary General of the Syndicate of Angolan Journalists (SJA), was targeted in 2024 with Predator spyware, according to Amnesty International.

The spyware, developed and sold by Intellexa for government surveillance, was installed on Cândido’s iPhone, marking the first confirmed use of Predator in Angola. The case emerged from a broader 2025 investigation into surveillance threats in Angola, initially conducted by Friends of Angola and Front Line Defenders.

Cândido described the impact the attack had on his personal privacy. He said: ‘I feel naked knowing that I was the target of this invasion of my privacy. I don’t know what they have in their possession about my life. Now I only do and say what is essential. I don’t trust my devices. I exchange correspondence, but I don’t deal with intimate matters on my devices. I feel very limited.’

Investigators reported that between April and June 2024, during the final months of his tenure as SJA Secretary General, Cândido received multiple WhatsApp messages from an unknown Angolan number. The sender used a common local name and posed as a student group interested in social and economic affairs before sending a malicious Predator link on 3 May at 16:18 local time.

Forensic analysis indicates that Cândido appears to have opened one link on 4 May, resulting in the spyware being installed. Experts noted that the infection appears to have been removed when the phone was restarted later that evening. Between 4 May and 16 June 2024, 11 additional Predator links were sent, all of which appear to have failed.

Amnesty International reported that the 2024 attack is among the most recently confirmed Predator cases, alongside a 2025 attack on a human rights lawyer in Pakistan’s Balochistan province. While the use of the spyware was confirmed, investigators did not attribute the attacks to any specific government customer.

The organisation also outlined the spyware’s technical capabilities, saying it can access encrypted messages, emails, call logs, passwords, photos, device locations, and can activate microphones while leaving no visible trace.

Cândido has also faced multiple incidents of intimidation since 2022, including unexplained break-ins at his office. Amnesty International stated that Predator has been used against individuals in Angola since at least early 2023.

The organisation sent a letter to Intellexa on 27 January 2026 requesting information about the company’s human rights due diligence processes. No response had been received by the time of publication.