A shocking new investigation by Amnesty International has revealed brazen spyware attacks targeting civil society, journalists, politicians, and academics in the European Union (EU), the United States (US), and Asia. The Predator spyware has been used against United Nations (UN) officials, US lawmakers, and even the Presidents of the European Parliament and Taiwan. This report, part of the ‘Predator Files’ project, was conducted in partnership with the European Investigative Collaborations (EIC) and supported by in-depth reporting from Mediapart and Der Spiegel.
Between February and June 2023, social media platforms X (formerly Twitter) and Facebook were exploited to target at least 50 accounts associated with 27 individuals and 23 institutions. The invasive spyware used was Predator, developed and marketed by the Intellexa alliance. This group, claiming to be “EU-based and regulated,” consists of several evolving companies specializing in surveillance technology, including the notorious Predator spyware.
The Invasive Nature of Predator Spyware
Predator is a highly intrusive spyware capable of accessing a device’s microphone, camera, and all stored data, including contacts, messages, photos, and videos, without the user’s knowledge. Currently, this spyware cannot be independently audited or restricted to specific, proportional functions, raising significant privacy concerns.
“Once again, we have clear evidence of powerful surveillance tools being misused for invasive attacks. The current targets include journalists in exile, public figures, and intergovernmental officials. But the real victims are our societies, good governance, and human rights as a whole,” said Agnes Callamard, Secretary General at Amnesty International.
Callamard added, “The Intellexa alliance, creators of Predator and other surveillance products, have done nothing to limit the use of this spyware. They are merely profiting while disregarding severe human rights implications. In light of this scandal, it is crucial for states to impose an immediate global ban on such highly invasive spyware.”
High-Profile Targets
Amnesty International’s Security Lab released a comprehensive report identifying high-profile targets of the Predator spyware, though it is not confirmed whether these individuals were infected. Targets include President of the European Parliament Roberta Metsola, President of Taiwan Tsai Ing-Wen, US Congressman Michael McCaul, US Senator John Hoeven, German Ambassador to the US Emily Haber, and French MEP Pierre Karleskind. The report also notes multiple officials, academics, and institutions were targeted.
A Surge of Unethical Attacks
Amnesty’s Security Lab has been investigating Predator’s use and its connection to Intellexa for an extended period. An attacker-controlled X account, ‘@Joseph_Gordon16’, was used to distribute malicious links aimed at infecting targets with Predator. One early target was Berlin-based journalist Khoa Lê Trung, editor-in-chief of thoibao.de, a news site banned in Vietnam. Trung has faced death threats for his reporting since 2018 in Vietnam’s repressive media environment.
Although the attack was unsuccessful, its significance is heightened by the fact that Trung and his site are based in the EU, where there are regulations governing the sale and transfer of surveillance technology. Trung highlighted, “You can’t just sell these tools to countries like Vietnam. It also undermines press freedom and freedom of expression here in Germany.”
Link to Vietnamese Authorities
The investigation found that ‘@Joseph_Gordon16’ had close ties to Vietnam and might have acted on behalf of Vietnamese authorities or interest groups. In April 2023, Amnesty observed this account targeting academics and officials working on maritime issues related to EU and UN policies on illegal fishing. Vietnam had received a ‘yellow card warning’ from the European Commission in 2017 for illegal fishing practices.
Donncha Ó Cearbhaill, Head of Amnesty International’s Security Lab, stated, “We observed numerous instances where ‘@Joseph_Gordon16’ posted malicious links to Predator, often disguised as benign news sources to trick users into clicking.”
Global Spread and Regulatory Failures
Predator is also capable of zero-click attacks, infiltrating devices without user interaction, which complicates investigations into its misuse. The spyware’s presence is documented in at least 25 countries across Europe, Asia, the Middle East, and Africa, revealing its extensive role in undermining human rights, press freedom, and social movements worldwide.
Amnesty International is calling for an immediate revocation of marketing and export licenses for Intellexa alliance products in all countries where it operates, including France, Germany, Greece, Ireland, Czech Republic, Cyprus, Hungary, Switzerland, Israel, North Macedonia, and the UAE. The organization demands a transparent, independent investigation into the unlawful targeting.
“Intellexa’s claim of being an ‘EU-based and regulated’ company highlights the failure of EU member states to prevent the proliferation of surveillance products despite previous investigations like the ‘Pegasus Project’ in 2021,” said Callamard. “This investigation shows that even EU officials and institutions have been caught in the net.”
Amnesty International’s findings reveal that Intellexa products have been sold to at least 25 countries, including Switzerland, Austria, Germany, Congo, Jordan, Kenya, Oman, Pakistan, Qatar, Singapore, the UAE, and Vietnam. The organization calls for an end to the production and sale of such invasive spyware and urges Intellexa to provide compensation to victims of unlawful surveillance.
Amnesty International has also released indicators to help technologists identify and respond to this spyware. Despite outreach to involved entities for comment, no responses were received, though EIC did hear from former executives of Nexa Group, who claimed Intellexa no longer exists and that Nexa Group only partially fulfilled its cybersecurity contract with Vietnam. They also stated that Intellexa entities complied with export regulations but acknowledged establishing commercial relations with countries with imperfect legal systems, often influenced by political choices from the French government.
Amnesty International also contacted Vietnam’s Ministry of Public Security but did not receive a response.
