- Home
- Z7 Cyber intelligence
- INTELLEXA
Intellexa
CLASSIFICATION
CRITICAL THREAT
15 Zero-Days | Active in 15+ Countries | Defying US Sanctions
The Mercenary Spyware Empire Defying Sanctions
The Intellexa consortium represents the most aggressive commercial spyware operation currently active. Despite US Treasury sanctions, leaked documents confirm the company retained remote access to customer surveillance systems and developed the “Aladdin” attack vector that weaponizes the commercial advertising ecosystem for zero-click infections requiring only that victims view a malicious ad on any website.
December 2025 Developments: The “Intellexa Leaks” exposed internal training videos, sales documentation, and technical specifications. The Trump administration removed sanctions on three executives on December 30, 2025.
Incident Assessments in this report
Z7-TAF Threat Actor Analysis
Full 8-dimension assessment of Intellexa's capabilities and operations
Greece Predatorgate Scandal (2022)
92 targets, PM's nephew resigned, EYP chief resigned - Z7-BAF 8.54
Intellexa Leaks Exposure (Dec 2025)
Internal operations, TeamViewer access, customer codenames exposed - Z7-BAF 7.89
The Aladdin Threat
Intellexa’s most dangerous innovation weaponizes the advertising ecosystem. They obtain a target’s IP address from cooperating mobile carriers, create a malicious ad targeting that specific IP, and serve it through standard ad networks. Simply rendering the advertisement triggers browser exploitation. No click required.
Victims encounter malicious content on trusted news sites, social media platforms, or mobile apps they use daily. This transforms every ad-supported website into a potential infection vector.
What's in the full intelligence report
- Complete Z7-TAF Analysis: All 8 dimensions scored with detailed rationale
- 2 Full Z7-BAF Incident Assessments: Predatorgate scandal and Intellexa Leaks exposure
- Complete Intellexa Corporate History: From Unit 81 to European spyware empire
- Predator Technical Architecture: ALIEN loader, persistence mechanisms, CyOP interface
- 15 Zero-Day CVE Analysis: Chrome, iOS, Android exploitation chains documented
- Aladdin Deep Dive: Advertising-based zero-click infection methodology
- Documented Victims: Heads of state, legislators, journalists across 15+ countries
- Comprehensive Defensive Recommendations: By role (executives, security teams, IT ops, legal)
