AN Angolan journalist and lawyer was infected with powerful commercial spyware on World Press Freedom Day last year, in what the Committee to Protect Journalists says is the first publicly documented case of spyware targeting in the country — a disturbing signal of how surveillance technology is being deployed to silence the press ahead of elections.
Teixeira Cândido, a prominent radio host and former union leader known for his criticism of Angola’s government, had his phone compromised with Predator spyware after clicking a malicious WhatsApp link on May 3, 2024, according to CPJ, citing forensic findings by Amnesty International’s Security Lab. The spyware — capable of accessing a device’s microphone, camera, messages, contacts, and photos without the user’s knowledge — was removed only when Cândido restarted his phone less than 24 hours later.
“I literally felt naked,” Cândido told CPJ. “It’s as if someone I don’t know had stripped me naked in public. I don’t know what kind of information they had access to. I don’t know to what extent they shared my intimate conversations.”
The attack was sophisticated and deliberate. CPJ reports the malicious link arrived from a sender using an Angolan phone number and a traditional Angolan name, posing as a representative of students seeking to discuss socioeconomic development. The attacker sent additional infected links over the following weeks, though Cândido did not click on them.
Predator is developed by the Intellexa Consortium, an international network of surveillance companies. Researchers at Amnesty International, the University of Toronto’s Citizen Lab, and cybersecurity firm Recorded Future have previously documented Predator infrastructure operating in more than a dozen countries, including Angola. No party has yet been identified as having ordered the surveillance of Cândido.
The revelation arrives against a backdrop of rapidly tightening restrictions on Angola’s press. CPJ has documented a wave of repressive legislation under President João Lourenço’s second term. Angola’s 2024 National Security Law granted security organs sweeping powers to disrupt telecommunications systems. A separate law that year criminalised filming or photographing law enforcement — though much of it was subsequently struck down as unconstitutional. Now, parliament is advancing two further draft laws: one targeting the spread of what authorities deem “false information,” and another expanding digital surveillance powers with limited judicial oversight.
“Only judges can authorise wiretaps, and only when there is suspicion that the person has committed a crime,” Cândido told CPJ. “I am a journalist, I am a lawyer. I don’t know to what extent there could be an order of this kind.”
Florindo Chivucute, executive director of Friends of Angola, told CPJ the country has effectively reverted to authoritarianism. “He managed to undo the steps that we have made in terms of creating institutions and guaranteeing certain freedoms,” Chivucute said of President Lourenço. “Now it’s fair to say Angola is an authoritarian regime.”
Angolan government officials pushed back on the spyware claims. The spokesperson for the General Prosecutor’s Office told CPJ the office “always tries to act within the limits of the law and has no knowledge of such situations.” A presidential spokesperson similarly said he had no knowledge of any proof of spyware use.
The case adds Angola to a growing list of countries where commercially available surveillance tools have been turned against the press. Accountability efforts elsewhere have yielded results: a U.K. court in January ordered Saudi Arabia to pay over £3 million in damages to a dissident targeted with Pegasus spyware, and a California judge in 2025 ordered NSO Group — Predator’s Israeli-developed rival — to halt attacks on WhatsApp users. A criminal trial is ongoing in Greece involving the targeting of journalist Thanasis Koukakis with Predator.
International pressure on Intellexa has nonetheless shown signs of softening. The United States sanctioned the consortium’s founder, Tal Dilian, and several linked firms in 2024, but in December 2025, three sanctioned individuals were quietly removed from the list. Five members of Congress wrote to the Treasury and State Departments on February 13 expressing “deep concern” and demanding a briefing.
Cândido is calling for accountability at home and solidarity abroad. “Surveillance ultimately threatens our professional activity,” he told CPJ. “We must unite and create a large international network, even against states, if necessary, to raise awareness, because it must be possible to defend freedom. Otherwise, one day we will wake up, and there will be no more journalism.”
