Human rights activists around the world have had a talented adversary for several years now who does not belong on the list of authoritarian governments. This adversary uses the staff of humanitarian organisations such as Amnesty International, whom it spies on through the Predator system.
We are talking about the Israeli business alliance Intellexa, which is developing the surveillance system. Its reach extends from Pakistan to Greece to the United States, where it has been sanctioned since last year. It was in the country, which some maps consider part of the "wider Middle East", that several Predator incidents took place over the summer, with the Pakistanis turning to Amnesty's forensic centre.
The result was a major investigative report, involving media outlets such as the Israeli daily Haaretz, Greece's Inside Story and the Swiss-based WAV Research Collective, whose findings were published by Germany's Inside IT. The paradox is that Islamabad has no diplomatic relations with Tel Aviv, as the authors of the Intellexa Leaks study point out.
The origins of the business network
A prominent place in the Intellexa Alliance network is occupied by Cytrox, which was founded in 2017 in what is now Northern Macedonia. It immediately received a financial injection from Israel Aerospace Industries [the manufacturer of the Barak-MX air defense systems, which was also bought by Slovakia, editor's note].
In 2019, a retired Aman military intelligence officer named Tal Dilian bought it for five million dollars. He was formerly the commander of Unit 81, responsible for the development and use of eavesdropping devices, and after leaving the army, he founded Intellexa - a company whose equipment, according to a Forbes magazine report, can fit in a single van.
Another branch of Cytrox was set up in Hungary, where one of the infamous cybersecurity consulting firms, BAC Consulting, also operates. Mossad intelligence agents posed as its employees when they ordered pagers from the Taiwanese firm Apollo Gold for the September 2024 attack on Hezbollah militants.
Amnesty has rated the Predator system as "highly invasive" as no user interaction is required to trigger it on a monitored device (a process known as zero-click surveillance). The organisation had already exposed the system in its 2023 Predator Files report.
Predator also came to attention the year before, specifically in Greece, where it was used to eavesdrop on a journalist named Thanasis Koukakis from 2021. The wiretap only came to light on February 28, 2022, after the results of an independent investigation by Citizen Lab were made public. At the same time, a surveillance operation by the Greek secret service EYP against opposition Social Democrats or independent journalists was also under way.
The Israeli-Macedonian-Hungarian system has also previously been used to spy on and commit 'fundamental human rights violations' in Egypt and Mexico. As part of the Intellexa Leaks investigation, Haaretz drew attention to an encrypted list of countries to which Intellexa offered its "services": Angola, Egypt, Kazakhstan, Libya, Pakistan, Saudi Arabia, Tajikistan and Uzbekistan.
However, Predator was also used by Vietnam's Secret Service to spy on at least four members of the US Congress. As a result, the Treasury Department imposed sweeping sanctions on Intellexa in March 2024, resulting in the consortium being banned from doing business on U.S. soil. Neither the Greek subsidiary Intellexa SA, the Irish Intellexa Ltd. or the Hungarian subsidiary Cytrox escaped the sanctions.
Threat of commercial espionage
The US Treasury Department, which is the main institution administering sanctions, warned back in the Joe Biden era of the worrying fact that, in contrast to the mutual spying by states during the Cold War, more and more private commercial actors are emerging.
Haaretz pointed out that Predator is one of the most effective spyware programs. "If successfully deployed and installed on a smartphone, it can hack the latest versions of Apple and Google's mobile operating systems, according to leaked materials," the newspaper explained.
"It extracts all content from hacked devices, including messages from encrypted messaging apps [Signal or Telegram, editor's note], eavesdrops on calls and remotely activates the microphone and camera, it also gains access to other services that the target uses through his phone," Haaretz continued.
The Predator is able to hack a device through a normal browser by introducing spyware into normal data traffic. Thus, any advertisement displayed via Chrome, for example, can be a carrier for the spyware - which is triggered without any reaction from the user.
In addition to the Intellexa documents, a prominent Israeli daily obtained several "training" videos that were produced as recordings of training sessions for new employees. As part of their job description, they were supposed to provide "remote support services" to clients, but the training coordinator used an interface called Eagle instead of an isolated internal system.
Amnesty's investigators uncovered Kazakhstan behind this code name - meaning that the new technicians were learning directly from data obtained by spying on the Central Asian country.
"The instructor explicitly states that he is connected to a live 'client environment,' not a fictitious system, and logs in remotely for training on what appears to be an active spying system used by the state, apparently without the need for approval from the client," Haaretz noted.
This is both a serious violation of Kazakh national security and the ethical rules of spyware developers. Indeed, companies like NSO Group routinely inform their clients that their systems have no "back door" through which the contractor's employees can access classified information.
Masters of eavesdropping
Highly sophisticated tools like Predator are also developed by NSO Group, Aladdin or Rayzone - Israeli spyware firms that regularly work with both the military and the Mossad. To restrict the sale of spying tools outside Israel, the Ministry of Defense issued a decree in 2023 banning the export of these systems. In the case of Aladdin, however, there was a leak, which Haaretz pointed out last year.
Haaretz and Amnesty published the findings of the investigation on December 4, "at a time when the spyware industry is no longer in the US spotlight and attempts to regulate it are waning," the newspaper noted.
"US President Donald Trump's return to the White House has slowly reversed key aspects of his predecessor's policies: although NSO and Candiru, along with Intellexa, are still blacklisted by the US Department of Commerce, both companies have been transferred to American ownership," Haaretz said.
In large part, this demonstrates the Trump administration's lax approach to Israeli espionage. As three anonymous White House officials revealed to Politico magazine in 2019, Israeli intelligence services installed listening devices around the presidential mansion that collected information for two full years.
"Over the past two years, the U.S. government has concluded that Israel was most likely behind the placement of the cell phone listening devices found near the White House and other sensitive locations in Washington," the weekly wrote.
"Unlike most other cases where flagrant instances of foreign spying have been uncovered on US soil, the Trump administration has not condemned the Israeli government, and there have been no consequences for Israel's behavior," it added.
The Trump administration has taken a similarly warm approach to convicted Israeli spy Jonathan Pollard. As a naval intelligence analyst since 1984, he had been gathering classified information and passing it on to Tel Aviv. He served 30 years, and was paroled in 2015. In December 2020, the US extradited him to Israel.
"You are home now," Prime Minister Benjamin Netanyahu welcomed Pollard.
The convicted spy was met quite cordially by the US ambassador to Jerusalem, Mike Huckabee, in July this year. The White House was "unaware" of the meeting, according to spokeswoman Caroline Leavitt, but the Central Intelligence Agency (CIA) was "concerned" and warned the government against further attempts at contact.