Haaretz: Predator, Developed By Israeli Spyware Firm Intellexa, Is One Of The Most Invasive Spywares On The Market. If Successfully Deployed And Installed On A Smartphone, There's Not Much It Can't Do

New victims of Predator spyware identified, with malicious TikTok links revealing new targets, and evidence shows Egypt and Saudi clients still active. Ad-based infections confirmed. Leaked files and investigation expose post-sanctions Intellexa operations

Last summer, a human rights lawyer in Pakistan received a WhatsApp message from an unfamiliar number. It was a journalist – allegedly – sending a link to an article that mentioned the lawyer by name. The journalist's profile picture looked legitimate, the article's headline plausible, the link purportedly belonging to the website of a prominent and trusted European media outlet. But the link was a trap, the site it led to was fake; someone was trying to hack into the lawyer's device.

Something about the message seemed suspicious, so the lawyer forwarded the link to Amnesty International researchers. Forensic analysis by their Security Lab revealed digital indicators known to the lab, that has long tracked spyware – it was Predator, the phone–hacking technology sold by Intellexa, a firm run by Israelis but based abroad and sanctioned by the U.S. According to forensic materials seen by the investigation, additional malicious links were sent to other targets in Pakistan, including politicians, in what was likely an attempt to infect their devices with the spyware.

Amnesty's findings on the lawyer are being published today as part of an international investigation called "The Intellexa Leaks," based on a leak of internal materials from the cyber firm and obtained by reporters. The investigation reveals for the first time the use of Predator spyware in Pakistan, a country that does not maintain diplomatic relations with Israel, and shows how Intellexa continues to sell its advanced hacking tools – despite two years of American sanctions.

Intellexa is likely the largest Israeli offensive cyber company operating outside of Israel and the marketer of the Predator spyware. It was founded by a former senior Military Intelligence officer and a pioneer of the digital surveillance industry, Tal Dilian. Both Dilian and his firm have long operated outside of the oversight of Israel's Defense Ministry – though much of its senior staff and owners are Israelis working abroad. In 2024, the United States imposed targeted personal sanctions on Dilian, who divides his time between Switzerland and Cyprus, and other executives, less than a year after the company itself was placed on an official U.S. blacklist reserved for companies acting against American interests and with whom U.S. entities are forbidden to do business.

Predator is one of the most invasive spywares on the market. If successfully deployed and installed on a smartphone, it can hack the most up-to-date versions of Apple and Google's mobile operating systems, according to leaked materials. It extracts all the contents from hacked devices, including messages from encrypted messaging applications, listens to calls, and remotely activates the microphone and camera, as well as gaining access to additional services used by the target from their phone.

🔗SOURCE ➡️ Haaretz [Archived Article]

Related: 11/25 — ✡️👁Do Israeli spies control your VPN?

11/16 — Unremovable Israeli Spyware Found On Samsung Devices

9/18 — A Recent Report Revealed That Appcloud, An Israeli Application Developed By Ironsource, Comes Pre-Installed On Certain Samsung Devices, Particularly Galaxy A And Galaxy M Models, And Cannot Be Fully Removed. The App Automatically Collects User Data, Including Location, Device Fingerprints, And IP Addresses.

2/2 — WhatsApp says journalists and civil society members were targets of Israeli spyware | WhatsApp | The Guardian

11/27/24 — Israel's NSO Group may know a lot more about how customers use its Pegasus commercial spyware product than the company has let on, newly released court documents...

Follow ➡️ @PsyopDaily