The IPI global network is alarmed over reports that Angolan journalist Teixeira Candido was targeted by Predator spyware, underscoring the pervasive threat that surveillance tech poses to journalists globally. We urge Angolan authorities to launch a thorough and independent investigation into the attack, publicly identify the source of surveillance, and ensure safeguards are put in place to prevent such future abuse.
IPI reiterates its previous calls – which are shared by journalism and civil society groups around the world – for a moratorium on the export, sale, and use of Pegasus, Predator, and other spyware weapons until effective human rights safeguards can be implemented.
Amnesty International’s Security Lab earlier this month reported that Candido’s mobile device had been targeted with Predator spyware in May 2024. Predator is a highly invasive mobile spyware developed and sold by Intellexa, a mercenary spyware company, for use by governments in surveillance operations.
Similar to Pegasus, Predator is capable of covertly accessing messages, calls, emails, stored files, cameras, microphones, and location data, among other information. IPI previously carried out in-depth reporting into the targeting of journalists in Greece using Predator.
According to the Amnesty International report, Candido’s phone was infected through a malicious link that was sent to him via a WhatsApp message from an unknown sender.
The spyware attack on Candido occurred at a time when he was actively involved in journalistic work and working as the head of the Syndicate of Angolan Journalists. Candido, who hosts a program on Radio Essencial, told IPI that he might have been targeted due to his views on the lack of media freedom in Angola. While the extent of the data monitored from his phone is unclear, Candido suspects that these attackers extracted all the information they could, including personal and professional data.
“This alarming and unchecked intrusion into a journalist’s private and professional communications poses a serious threat to press freedom in Angola. This incident highlights a broader, deeply concerning trend where highly invasive surveillance technologies are being acquired and used without adequate legal, ethical, or human rights safeguards. IPI repeats our call for robust accountability mechanisms to prevent the misuse of such spyware to target journalists, activists, and civil society actors,” Nompilo Simanje, IPI’s Africa Advocacy and Engagement Lead, said.
Journalists in Africa have repeatedly been targeted in spyware attacks. Previous investigations by Citizen Lab have identified several African nations, including Morocco, Rwanda, Togo, Zambia, Zimbabwe, Kenya, and Uganda, as likely or confirmed operators of the NSO Group’s Pegasus spyware. In Togo, at least five journalists have been reported to have been targeted with Pegasus spyware between 2021 and 2025. Kenyan photojournalist and activist Boniface Mwangi also reported fearing for his life after researchers found a surveillance tool linked to police had been installed on his phone during his arrest in 2025. Peter Verlinden, a Belgian journalist covering Rwanda, was also targeted by Pegasus spyware in September 2021.
The revelations come as Angola is considering a new cybersecurity law that would expand state surveillance powers.
“Rather than bolstering safeguards to counter digital threats like spyware and denial of service attacks against journalists, authorities across the region have instead relied on cybercrime law and other overly broad laws to target journalists and undermine media freedom, such as in Zimbabwe, Nigeria, and Malawi, among others,” Simanje added.