Skip to content
844-974-8669 Ask Zeus Book a call

Intelligence briefFall/Winter 2026/2027 Edition

Intellexa's Predator persisted under US sanctions as Greece convicted four

Google and Recorded Future found Intellexa's Predator still running in late 2025 despite US sanctions, and an Athens court convicted four people in 2026. Patch phones fast and use Lockdown Mode for high-risk staff.

Download the PDF, 857 KB Talk to the SOC
Part 1 of 2 · Intellexa

At a glance

SP-01 · Spyware vendor

  • 15 zero-days attributed to Intellexa since 2021[6]
  • 4 convicted in Athens, sentences capped at 8 years, suspended pending appeal[13]
  • 3 of 7 sanctioned individuals delisted by the Treasury on December 30, 2025[17]
  • 87+ victims verified by the Athens court, at least[12]
Status
Active. Recorded Future's December 2025 report found customers in Saudi Arabia, Kazakhstan, Angola and Mongolia still communicating with Predator infrastructure and concluded Intellexa remains active, though use appeared to slow in 2025; the latest operational evidence reviewed dates from December 2025.[33]
Initial access
One-click links over messaging apps such as WhatsApp; ISP-level network injection (Mars, Jupiter); Aladdin ad vector described in leaked documents, with in-the-wild use unconfirmed[8]
Zero-days attributed
15 of about 70 documented by Google's TAG since 2021, all patched[6]
US sanctions
Dilian, Bitzios, Artemiou, Karaoli, five Intellexa entities and Aliada Group remain on the SDN list; Hamou, Harpaz and Gambazzi were removed December 30, 2025[4]
Prosecution
Four convicted in Athens on February 26, 2026; sentences suspended pending appeal; a prosecutor asked for further investigation including possible espionage charges[13]
Recent confirmed case
Amnesty confirmed in February 2026 that Predator infected Angolan journalist Teixeira Cândido's iPhone on May 4, 2024[10]
Platforms
iOS and Android through mobile browser exploits; a Samsung Exynos baseband exploit (Triton) appears in leaked documents, recent use unclear[8]

What happened

Intellexa builds and sells the Predator spyware suite to government customers. The US Treasury sanctioned its founder Tal Dilian and core entities in 2024, the Commerce Department placed four entities on the Entity List in 2023, and leaked files published in December 2025 showed staff could reach live customer surveillance systems. After the sanctions, Google and Amnesty International still found Predator in use, and Google reported that Intellexa kept procuring or developing new zero-day exploits.

  • Google's Threat Intelligence Group attributes 15 unique zero-days to Intellexa since 2021, including CVE-2025-6554 in Chrome (observed in Saudi Arabia in June 2025) and CVE-2025-48543 in the Android Runtime, and calls the vendor one of, if not the most, prolific spyware vendors exploiting zero-days against mobile browsers.
  • The December 4, 2025 Intellexa Leaks (Inside Story, Haaretz and WAV Research Collective, with technical analysis by Amnesty International) include a mid-2023 training video in which an instructor connects through TeamViewer to a deployed customer system codenamed EAGLE_2, which Amnesty attributes to Kazakhstan; a control panel in the video lists at least ten potential customers.
  • The same files describe Aladdin, a vector designed to infect a phone when a targeted advertisement is merely viewed, aimed by public IP address that an operator can request from a domestic mobile operator. Amnesty believes it was supported in active deployments in 2024; Recorded Future says it is not aware of any reporting that Aladdin has been used in the wild.
  • On February 26, 2026 an Athens court convicted Dilian, Sara Hamou, Felix Bitzios and Yiannis Lavranos, owner of the Greek firm Krikel, of violating communications secrecy and data protection laws; each was sentenced to 126 years and eight months, which Greek law caps at eight years for misdemeanors, suspended pending appeal. The court found Predator was used to surveil at least 87 verified victims.
  • On December 30, 2025 the Treasury removed Hamou, Merom Harpaz and Andrea Gambazzi from the SDN list; a US official said each had demonstrated measures to separate from the consortium, and five senators demanded a briefing by February 27, 2026.
  • Amnesty International confirmed in February 2026 that Predator infected Angolan journalist Teixeira Cândido's iPhone on May 4, 2024, the first forensically confirmed Predator case targeting civil society in Angola, with possible Angola-linked infection domains first seen in March 2023.

How it works

The attack as a living map, in kill-chain order from the first foothold to impact. Point at a step to light its wiring, click to pin its story.

at risk
  • entry
  • next step
  • impact

Read the attack chain

The threat on the left, each step in order, the people at risk on the right: point at a step to light its wiring, click to pin its story here.
00the attack chain
  • entry
  • next step
  • impact

Tap a node to read its story.

Step by step

  1. Target selection and delivery

    Operators send a one-click link over a messaging app such as WhatsApp, inject a link into unencrypted traffic with ISP cooperation (Mars) or into domestic HTTPS sites where the customer holds certificates (Jupiter), or, per leaked documents, buy a targeted advertisement keyed to the target's public IP address (Aladdin). Google saw malicious ads fingerprint users and redirect a few customers' targets to exploit servers.

  2. Browser exploitation

    A mobile browser zero-day chain gives remote code execution, then a sandbox escape and privilege escalation. Google's list includes V8 type confusion bugs for Chrome, a WebKit chain delivered through a framework called JSKit on iOS, and CVE-2025-48543, a use-after-free in the Android Runtime used for sandbox escape and privilege escalation.

  3. Implant installation

    Predator lands as a modular implant. On iOS, Jamf's February 2026 analysis shows a component that hooks SpringBoard so the camera and microphone indicators never appear once the device is fully compromised; Jamf says this is not a vulnerability disclosure.

  4. Anti-analysis and kill switch

    A watcher checks for developer mode, jailbreak artifacts, security tools and a US or Israeli locale. If a check fires, the implant reports an error code in the 301 to 311 range to its command server and exits, which gives the operator a diagnostic on why a deployment failed.

  5. Command and control

    Delivery and command infrastructure is multi-tiered. Recorded Future reported an additional tier that anonymizes customer operations after the sanctions and exposure, and in December 2025 found less infrastructure than in 2024, a push to hide infrastructure behind Cloudflare, and domain naming changes that make it harder to tie domains to customers.

  6. Vendor-side visibility

    Leaked training material shows Intellexa staff connecting to a customer system over TeamViewer and viewing logs of live infection attempts. Amnesty notes that mercenary spyware vendors typically say they have no access to customer systems once installed.

Who is at risk

Predator is sold to governments and used against the people those governments want to watch. Treasury said it was used to target Americans including US government officials, journalists and policy experts; the senators' February 13, 2026 letter says foreign actors used it to surveil officials including members of Congress, and ICIJ reports the Greek victims included government ministers, military officials, journalists and the leader of the main opposition party.

  • Journalists, press freedom advocates and human rights lawyers in or connected to Predator-active countries (Amnesty cites cases in Angola, Egypt, Pakistan and Greece).
  • Opposition politicians, as in the cases of Egyptian presidential hopeful Ahmed Eltantawy (Citizen Lab) and Greek opposition leader Nikos Androulakis (Amnesty).
  • Executives, politicians and others in sensitive roles, whom Recorded Future says Predator's high cost points operators toward; it saw customers still active in late 2025 in Saudi Arabia, Kazakhstan, Angola and Mongolia, with new evidence for Iraq.
  • Anyone on an unpatched phone: every Intellexa zero-day Google lists has a vendor patch, and the Angolan victim's iPhone was on iOS 16.2, which Amnesty calls outdated, though it says it is unclear whether that mattered.
  • Organizations whose suppliers or counterparties touch the sanctioned entities, since the SDN and Entity List entries remain in force.

Sectors in scope

  • Journalists and press freedom organizations
  • Opposition politicians and parliamentarians
  • Human rights defenders and lawyers
  • Government officials, including US officials (Treasury) and members of Congress (senators' letter)
  • Ministers, military officials and business figures (Greek victim set)
04What changed

What changed since the last edition

Fall/Winter 2026/2027 Edition8 changes

  1. An Athens court convicted Tal Dilian, Sara Hamou, Felix Bitzios and Yiannis Lavranos on February 26, 2026 of breaching the confidentiality of telephone communications and illegally accessing information systems; the sentences were suspended pending appeal and a prosecutor asked for further investigation including possible espionage charges. Citizen Lab's John Scott-Railton called it the first time an executive at a mercenary spyware company had been convicted and sentenced to prison.

    Source 13

  2. Dilian told Reuters on March 24, 2026 that he will appeal and take his case to national, regional and international institutions; the Greek government spokesman said on March 27, 2026, as reported by Dnews, that he has been convicted at first instance and is now a defendant in an appeal trial.

    Source 14

  3. The Treasury removed Hamou, Harpaz and Gambazzi from the SDN list on December 30, 2025, 26 days after the leaks; a US official told The Record each had demonstrated measures to separate from the consortium. Senators Bennet, Warren, Shaheen, Kim and Schiff wrote on February 13, 2026 that three of the seven designated individuals were removed without the briefing committee staff requested on December 10, 2025, and asked for one by February 27, 2026. As of October 14, 2026 Dilian, Bitzios, Artemiou, Karaoli, the five consortium entities and Aliada Group remain on the SDN list, per the Consolidated Screening List.

    Source 17

  4. Amnesty International's Security Lab forensically confirmed that Predator infected Angolan journalist Teixeira Cândido's iPhone on May 4, 2024, and determined with high confidence that the WhatsApp links he received were Predator infection attempts; its event timeline lists 11 messages with Predator links starting May 3, 2024, and it cannot conclusively identify the customer.

    Source 10

  5. Jamf Threat Labs reverse engineered a Predator iOS sample on January 14, 2026 and documented its anti-analysis checks (developer mode, jailbreak artifacts, security tools, US or Israeli locale), an error code taxonomy (301 to 311) reported to the command server, and crash log suppression.

    Source 24

  6. Google's March 5, 2026 zero-day review counted 90 exploited zero-days in 2025, with 15 on mobile operating systems versus 9 in 2024, and for the first time attributed more exploitation to commercial surveillance vendors than to state-sponsored espionage groups; it describes Intellexa as a prolific procurer and user of zero-days that adapted its operations.

    Source 7

  7. Recorded Future's December 3, 2025 report found less Predator infrastructure in 2025 than in 2024, customers in Saudi Arabia, Kazakhstan, Angola and Mongolia still communicating, customers in Egypt, Trinidad and Tobago and Botswana ceasing communication between March and June 2025, and, with medium confidence, a customer in Iraq likely operational in 2025.

    Source 33

  8. In July 2026 eight Greek victims reportedly filed a civil damages claim of about 8 million euros in Athens against Intellexa and 13 people including Dilian; Reclaim The Net, citing Heise, reports a hearing in April 2027. This rests on one advocacy outlet's secondary reporting and is unconfirmed by a court record or wire report.

    Source 16

What to do now

In priority order, highest impact first.

  1. Do firstTurn on Lockdown Mode on the iPhones of executives, counsel, board members and anyone who travels to a Predator-active country.

    Citizen Lab reported that Apple's security engineering team confirmed Lockdown Mode blocks the Predator attack used against Ahmed Eltantawy in 2023, and Recorded Future also recommends it against advanced spyware.

  2. Enforce mobile OS and browser updates within days, not weeks, and block access from devices below the current release.

    Every zero-day Google attributes to Intellexa has a vendor patch, and the Angolan victim's phone was on iOS 16.2 when it was infected.

  3. Deploy ad and script blocking in managed mobile browsers and treat it as a security control.

    Leaked documents describe Aladdin infecting a phone when a targeted ad is merely viewed, Google saw malicious ads redirect Predator targets to exploit servers, and Recorded Future recommends ad blocking.

  4. Require MDM enrollment with minimum OS versions for any device that reaches corporate email or data, and deny unenrolled BYOD.

    Every Intellexa zero-day Google lists was patched and Google urges quick patching; MDM minimum versions are how an organization enforces that on devices it does not physically control.

  5. Add mobile telemetry for camera or microphone use without an on-screen indicator, unexpected memory mappings in SpringBoard or mediaserverd, and processes such as iconservicesagent running from /private/var/containers/Bundle/.

    These are behaviors Jamf documented in an analyzed Predator sample and Amnesty documented on a confirmed infection.

  6. Screen vendors, resellers and counterparties against the OFAC SDN list and the BIS Entity List, including the rebrands Helios, Nova, Green Arrow and Red Arrow.

    Intellexa S.A., Intellexa Limited, Cytrox AD, Cytrox Holdings, Thalestris and Aliada Group remain on the SDN list (the first four also on the Entity List), and Predator has been marketed under other names.

  7. Brief high-risk staff that unsolicited WhatsApp links, even from a plausible journalist or student, are hostile, and give them a reporting path.

    The Angola and Pakistan cases both involved a one-click link sent over WhatsApp, in Pakistan from an unknown number.

  8. Fold commercial spyware into the incident response plan, including forensic capture of iOS backups and Android bug reports before a reboot.

    Cândido's infection ended when his phone restarted, which is good for the victim and bad for the evidence; a Z7 24/7 SOC engagement can add mobile telemetry and a tested response path.

Indicators

Indicators the sources publish, shown as they print them. Use them to hunt and to enrich alerts, and check the source before you block.

Indicators published by the sources
TypeIndicatorSource
domain exclusivo24h[.]com [10]
behavior Process named iconservicesagent running from /private/var/containers/Bundle/ on iOS [10]
behavior Camera or microphone in use with no indicator shown; SpringBoard receives sensor notifications without updating the UI [25]

Sources

Every number and claim in this brief traces to a source below. Each source opens in a new tab at the publisher.

  1. [1]
    Treasury Sanctions Members of the Intellexa Commercial Spyware Consortium (opens in a new tab) US Department of the Treasury · March 5, 2024 · home.treasury.gov
  2. [2]
    Cyber-related Designations; Global Magnitsky Designations (opens in a new tab) US Treasury, Office of Foreign Assets Control · September 16, 2024 · ofac.treasury.gov
  3. [3]
    Non-Proliferation and Iran-related Designations; Cyber-related and Russia-related Designations Removals (opens in a new tab) US Treasury, Office of Foreign Assets Control · December 30, 2025 · ofac.treasury.gov
  4. [4]
    Consolidated Screening List (CSV download, checked for Intellexa-related entries) (opens in a new tab) US International Trade Administration · retrieved October 14, 2026 · data.trade.gov
  5. [5]
    Commerce Adds Four Entities to Entity List for Trafficking in Cyber Exploits (opens in a new tab) US Bureau of Industry and Security · July 18, 2023 · bis.gov
  6. [6]
    Sanctioned but Still Spying: Intellexa's Prolific Zero-Day Exploits Continue (opens in a new tab) Google Threat Intelligence Group · December 3, 2025 · cloud.google.com
  7. [7]
    Look What You Made Us Patch: 2025 Zero-Days in Review (opens in a new tab) Google Threat Intelligence Group · March 5, 2026 · cloud.google.com
  8. [8]
    To Catch a Predator: Leak exposes the internal operations of Intellexa's mercenary spyware (opens in a new tab) Amnesty International Security Lab · December 4, 2025 · securitylab.amnesty.org
  9. [9]
  10. [10]
    Journalism under attack: Predator spyware in Angola (opens in a new tab) Amnesty International Security Lab · February 18, 2026 · securitylab.amnesty.org
  11. [11]
  12. [12]
  13. [13]
  14. [14]
    Intellexa founder says he plans to appeal Greek court ruling over wiretapping scandal (opens in a new tab) Reuters (republished by Internazionale) · March 24, 2026 · internazionale.it
  15. [15]
  16. [16]
  17. [17]
    Letter to Secretaries Bessent and Rubio regarding commercial spyware sanctions delistings (opens in a new tab) US Senators Bennet, Warren, Shaheen, Kim and Schiff · February 13, 2026 · bennet.senate.gov
  18. [18]
  19. [23]
    Predator Spyware Infrastructure Returns Following Exposure and Sanctions (opens in a new tab) Recorded Future Insikt Group · 2024 (report cta-2024-0905; page shows no date) · recordedfuture.com
  20. [24]
  21. [25]
    How Predator spyware defeats iOS recording indicators (opens in a new tab) Jamf Threat Labs · February 19, 2026 · jamf.com
  22. [26]
  23. [27]
    Apple Warns Users in 110 Countries They May Be Targets of Mercenary Spyware (opens in a new tab) The Hacker News · August 14, 2026 (updated August 18, 2026) · thehackernews.com
  24. [29]
  25. [31]
    EU Civil-Liberties Groups Demand Action on Pegasus Hit on PEGA MEP (opens in a new tab) State of Surveillance · July 7, 2026 · stateofsurveillance.org
  26. [32]
  27. [33]
    Intellexa's Global Corporate Web (opens in a new tab) Recorded Future Insikt Group · December 3, 2025 (page updated February 20, 2026) · recordedfuture.com
  28. [34]
  29. [35]

The series: Intellexa

2 parts

  1. Part 1 of 2 · you are readingPredator persists as Greece convicts four
  2. Part 2 of 2 · read nextSpyware vendors lead zero-days; Aladdin unconfirmed

Z7 Weekly Intelligence

One email a week: the threats that matter, new Z7 intelligence briefs and articles, and what to do about them. Unsubscribe anytime.

By subscribing, you agree to our Terms of Use. Our Privacy Policy explains how we use your email.

All Z7 Cyber Intelligence briefs
  • SP-03Spyware vendor ongoing risk

    Spyware vendors outlast sanctions and verdicts

    TakeawayPatch fast; treat Apple alerts as incidents.

    • 90 zero-days exploited in the wild in 2025
    • 110 countries in Apple's August 2026 spyware alert wave
    • Commercial spyware industry
    • Spyware vendor
    • Government officials and legislators
    PDF844 KB
  • IS-01Infostealer active

    Odyssey Stealer now leads macOS stealers

    TakeawayBlock Terminal paste lures, patch macOS and revoke sessions fast.

    • 62.7% of macOS stealer detections, first half of 2026
    • 100+ countries with infections, per Moonlock in July 2026
    • Odyssey Stealer
    • Infostealer
    • Technology and software development
    PDF901 KB
  • RW-07Ransomware ecosystem ongoing risk

    Most dangerous cybercrime groups, re-ranked

    TakeawayPatch edge devices, require phishing-resistant MFA and test backups first.

    • 2,139 leak-site victims in Q2 2026, up 33 percent year over year
    • 93 active groups in Q2 2026, a record for a quarter
    • Most dangerous cybercrime groups
    • Ransomware ecosystem
    • Manufacturing
    PDF887 KB

Want this threat watched in your environment?

Talk to the team that runs the Z7 SOC about what this brief means for you. We will tell you what applies to your environment and what does not.

Talk to the SOCContact Z7 Call 844-974-8669
Ask Zeus AI assistant