The spy in your pocket: How mercenary malware is silencing African dissent

Two prominent government critics in Angola and Kenya say their phones were compromised using commercial surveillance technology, as rights groups warn that powerful digital tools are increasingly being turned on journalists and activists across Africa.

In a report released Wednesday, Amnesty International said Angolan journalist Teixeira Candido was briefly infected with the Predator spyware in May 2024, a hack it described as part of a wider pattern of spyware attacks in the country. In Kenya , activist Boniface Mwangi told AFP he feared for his life after researchers found a surveillance tool linked to police had been installed on his phone during his arrest last year.

The two cases illustrate different ways digital surveillance can be deployed – from remote infection attempts designed to trick targets into installing malware, to the use of tools that extract data when authorities gain physical access to devices.

Amnesty said Predator, made by spyware firm Intellexa, can allow hackers to access photos and messages and remotely activate a phone’s camera and microphone. It said Candido, then in the final months of a 10-year term as secretary-general of the Angolan journalists’ union, was approached by an attacker posing as students interested in Angola’s development.

The attacker sent WhatsApp links that appeared to be news articles but were designed to lure Candido into installing the spyware, Amnesty said. The infection lasted less than a day and was removed after the phone was restarted, according to the group.

I feel I could be a target for elimination

“When I think that I have been the victim of an invasion of my privacy, I feel exposed. I don’t know what information they have my life,” Candido said, quoted by Amnesty.

The rights group said it could not attribute the attack to a specific government, but argued it was “certainly part of a wider campaign of attacks involving spyware in the country”, as Angola has passed laws in recent years that critics say restrict press freedom and the right to protest. Amnesty said Intellexa had not responded to a request for .

Predator has previously featured in a wiretap scandal in Greece, where revelations that the state intelligence agency used the malware to spy on ministers, journalists and business executives shook the government in 2022. In 2023, Intellexa was placed on a US list of companies seen as threats to national security, alongside Cytrox , which developed Predator in North Macedonia.

In Kenya, Citizen Lab – a research group at the University of Toronto – said Tuesday that a surveillance tool developed by Israeli company Cellebrite was installed on Mwangi’s phone without his consent after police raided his and office in July 2025 . Police seized his phones and computer hard drives and accused him of “facilitation of terrorist acts”.

Citizen Lab said the tool gave police access to “messages, private files, personal documents, financial information, passwords, and other sensitive data”. Cellebrite’s products are used by law enforcement agencies worldwide to unlock smartphones and for evidence, but rights groups, including Amnesty, have raised concerns their use in targeting journalists and activists.

Mwangi told AFP he had “life-threatening concerns” and felt “violated”, citing a history of killings and disappearances linked to police since anti-government protests in 2024. “I feel I could be a target for elimination,” he said, adding that he feared for the safety of people close to him and for members of his presidential campaign team. AFP contacted Kenyan police for .

Mwangi said he would use Citizen Lab’s findings in court to challenge criminal charges he still faces, asking judges to prevent authorities from leaking private material, including family photos.