# Hack-for-Hire Espionage Campaign Targeting MENA Civil Society via Predator/Intellexa Mercenary Spyware

> Active hack-for-hire espionage campaign leveraging Intellexa's Predator mercenary spyware to target journalists, human rights defenders, and government critics across the MENA region and beyond. The campaign employs sophisticated spear phishing via encrypted messaging apps, weaponized OAuth consent phishing, network injection via ISP-level MITM devices, and the novel Aladdin zero-click advertising-based delivery system.

- **Published:** 2026-04-08T12:00:00Z
- **Last reviewed:** 2026-04-08T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0333
- **ID:** TL-2026-0333
- **Severity:** HIGH
- **Category:** APT
- **Status:** ACTIVE
- **Actor:** Intellexa Alliance
- **Detections:** 9 · **IOCs:** 46 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2023-41991, CVE-2023-41992, CVE-2023-41993, CVE-2023-4762, CVE-2023-3079, CVE-2023-2136, CVE-2023-2033, CVE-2021-38003, CVE-2021-38000, CVE-2021-37976, CVE-2021-37973, CVE-2021-1048, CVE-2024-4610, CVE-2025-6554, CVE-2025-48543

## Description

Intellexa Alliance — a consortium of European surveillance companies including Cytrox, Nexa Technologies, WiSpear, and Senpai Technologies, founded by former IDF Unit 81 commander Tal Dilian — operates the Predator commercial spyware platform, which has been deployed against civil society targets across the Middle East and North Africa (MENA) region and globally.

Predator is a sophisticated mobile implant targeting both iOS and Android devices. On iOS, it persists across reboots by abusing the iOS Automations/Shortcuts feature via the siriactionsd process, executing as root-level processes capable of accessing encrypted messaging apps (Signal, WhatsApp), activating microphones and cameras, harvesting credentials, capturing screenshots, recording calls, and exfiltrating GPS coordinates. The spyware employs an intelligent collection strategy that monitors battery level, charger status, and network type to minimize detection through excessive resource consumption.

The campaign utilizes multiple delivery vectors:

1. ONE-CLICK SPEAR PHISHING: Attackers send tailored WhatsApp or SMS messages containing malicious links that redirect through URL shortener infrastructure (e.g., c.betly[.]me) to exploit servers (e.g., sec-flare[.]com). Links are themed with region-specific lures — Egyptian news sites (almasryelyuom[.]com mimicking Al Masry Al Youm), Kazakhstani media (kz-news[.]cc), and Indonesian outlets (kejoranews[.]net). The infection chain triggers browser zero-day exploits and completes within minutes.

2. NETWORK INJECTION (MARS/JUPITER): ISP-level man-in-the-middle attacks using Sandvine PacketLogic middleboxes positioned at telecom boundaries. When targets visit HTTP sites, traffic is intercepted and redirected to exploit infrastructure. This was documented in the Ahmed Eltantawy targeting where a device at the Telecom Egypt/Vodafone Egypt border persistently redirected his mobile traffic to Predator exploit servers.

3. ALADDIN ZERO-CLICK AD DELIVERY: A novel vector developed by 2022 and actively deployed since 2024. Aladdin forces malicious advertisements onto target devices using public IP addresses obtained from domestic mobile operators as targeting identifiers. The advertisement itself triggers infection without user interaction. Infrastructure is operated through shell companies Pulse Advertise and MorningStar TEC.

4. OAUTH CONSENT PHISHING: Documented against Egyptian civil society since 2019, attackers create malicious OAuth applications (e.g., 'Secure Mail') that request account access permissions. This bypasses two-factor authentication because victims authenticate directly through the legitimate service. Targeted accounts included human rights defenders, NGO staff, and media organizations.

Since 2021, Intellexa has burned through 15 unique zero-day exploits across Chrome V8, Safari WebKit, iOS kernel, and Android components. Notable exploit chains include the September 2023 iOS attack on Ahmed Eltantawy using CVE-2023-41991 (certificate validation bypass), CVE-2023-41992 (XNU kernel privilege escalation), and CVE-2023-41993 (WebKit JIT RCE), plus the 2025 chain using CVE-2025-6554 (Chrome V8 type confusion) and CVE-2025-48543 (Android runtime UAF).

The December 2025 Amnesty International 'Intellexa Leaks' investigation exposed internal operations including TeamViewer-based remote access to customer surveillance systems, Elasticsearch logging dashboards, and the PDS/HDS customer dashboard used to add targets and create infection links. Google TAG simultaneously notified hundreds of targeted accounts across Pakistan, Kazakhstan, Angola, Egypt, Uzbekistan, Saudi Arabia, and Tajikistan.

In February 2026, Amnesty confirmed Predator infection on Angolan journalist Teixeira Candido's iPhone, with the May 2024 attack delivered via WhatsApp from a local Angolan number. Access Now's March 2026 webinar documented ongoing spear phishing campaigns against Egyptian journalists and human rights defenders, confirming the campaign remains active despite US OFAC sanctions imposed on Intellexa in 2023.

Confirmed Predator customer nations include Egypt, Greece, Armenia, Indonesia, Madagascar, Oman, Saudi Arabia, Serbia, Kazakhstan, Angola, Democratic Republic of Congo, Pakistan, Mongolia, Sudan, and Botswana. Internal customer codenames include Dragon, Eagle, Falcon, Flamingo, Fox, Glen, Lion, Loco, Phoenix, Rhino, and Demo_Master.

## MITRE ATT&CK

- T1589 Gather Victim Identity Information
- T1583 Acquire Infrastructure
- T1587 Develop Capabilities
- T1588 Obtain Capabilities
- T1566 Phishing
- T1189 Drive-by Compromise
- T1203 Exploitation for Client Execution
- T1204 User Execution
- T1547 Boot or Logon Autostart Execution
- T1068 Exploitation for Privilege Escalation
- T1036 Masquerading
- T1070 Indicator Removal
- T1553 Subvert Trust Controls
- T1528 Steal Application Access Token
- T1056 Input Capture
- T1082 System Information Discovery
- T1123 Audio Capture
- T1113 Screen Capture
- T1005 Data from Local System
- T1125 Video Capture
- T1114 Email Collection
- T1071 Application Layer Protocol
- T1090 Proxy
- T1041 Exfiltration Over C2 Channel
- T1557 Adversary-in-the-Middle

## Sources

- [Intellexa Leaks Expose Predator Spyware Operations - Amnesty International Security Lab](https://securitylab.amnesty.org/latest/2025/12/intellexa-leaks-predator-spyware-operations-exposed/)
- [Amnesty Finds Predator Spyware on Angolan Journalist iPhone](https://cyberwarzone.com/2026/02/18/amnesty-finds-predator-spyware-on-angolan-journalists-iphone/)
- [Access Now Digital Security Webinar - Spear Phishing Against Civil Society](https://www.accessnow.org/event/digital-security-webinars/)
- [Predator vs Pegasus - Citizen Lab Initial Discovery](https://citizenlab.ca/2021/12/pegasus-vs-predator-dissidents-doubly-infected-iphone-reveals-cytrox-mercenary-spyware/)
- [Predator in the Wires - Ahmed Eltantawy Targeted - Citizen Lab](https://citizenlab.ca/2023/09/predator-in-the-wires-ahmed-eltantawy-targeted-with-predator-spyware-after-announcing-presidential-ambitions/)
- [0-days Exploited by Commercial Surveillance Vendor in Egypt - Google TAG](https://blog.google/threat-analysis-group/0-days-exploited-by-commercial-surveillance-vendor-in-egypt/)
- [Intellexa Zero-Day Exploits Continue - Google Cloud Threat Intelligence](https://cloud.google.com/blog/topics/threat-intelligence/intellexa-zero-day-exploits-continue)
- [The Predator Spyware Ecosystem Is Not Dead - Sekoia TDR](https://blog.sekoia.io/the-predator-spyware-ecosystem-is-not-dead/)
- [Predator Spyware Infrastructure Returns Following Sanctions - Recorded Future](https://www.recordedfuture.com/research/predator-spyware-infrastructure-returns-following-exposure-sanctions)
- [Predators for Hire - Global Overview of Commercial Surveillance Vendors - Sekoia](https://blog.sekoia.io/predators-for-hire-a-global-overview-of-commercial-surveillance-vendors/)
- [CyberScoop - Intellexa Remotely Accessed Customer Systems](https://cyberscoop.com/intellexa-remotely-accessed-predator-spyware-customer-systems-investigation-finds/)
- [Phishing Attacks Using Third-Party Applications Against Egyptian Civil Society - Amnesty](https://www.amnesty.org/en/latest/research/2019/03/phishing-attacks-using-third-party-applications-against-egyptian-civil-society-organizations/)
- [Predator Files Spyware Scandal - Amnesty International](https://www.amnesty.org/en/latest/news/2023/10/global-predator-files-spyware-scandal-reveals-brazen-targeting-of-civil-society-politicians-and-officials/)
- [Intellexa Predator Used to Hack Angolan Journalist iPhone - TechCrunch](https://techcrunch.com/2026/02/17/intellexas-predator-spyware-used-to-hack-iphone-of-journalist-in-angola-research-says/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0333