By Staff Reporter
ISLAMABAD: An Israeli-made spyware tool, long associated with human rights violations around the world, has been deployed against targets in Pakistan, according to a new investigation by Amnesty International that marks the first documented case in the country.
The spyware, known as Predator and produced by the Israeli company Intellexa, was identified in an attempted attack on a human rights lawyer in the restive province of Balochistan this summer, the report said. Israel, where Intellexa is based, maintains no diplomatic relations with Pakistan, adding a layer of geopolitical intrigue to the findings.
The investigation, titled “Intellexa Leaks” and released on Thursday, draws on a trove of leaked internal documents from the company, including sales and marketing materials, training videos and other sensitive records. It was published in collaboration with Inside Story in Greece, Haaretz in Israel and the WAV Research Collective in Switzerland.
Amnesty International’s Security Lab analysed a suspicious link sent via WhatsApp to the lawyer from an unknown number in the summer of 2025. The link exhibited technical behaviors consistent with a Predator infection server, and its one-time infection characteristics matched those seen in prior Predator one-click attacks, the report detailed. This incident represents the first reported use of Predator in Pakistan, a development that shows the spyware’s expanding reach into regions where surveillance tools have drawn scrutiny for stifling dissent.
Predator, Intellexa’s flagship product, is designed for government clients and enables highly invasive monitoring. It typically relies on “1-click” attacks, where a target must open a malicious link on their phone. The link then exploits vulnerabilities in browsers like Chrome or Safari to gain initial access and install the full spyware payload. Once embedded, the tool can harvest a wide array of data: encrypted messages from apps like Signal and WhatsApp, audio recordings, emails, device locations, screenshots, camera photos, stored passwords, contacts and call logs.
It can also activate the device’s microphone for real-time eavesdropping. The spyware relays this information back to a backend server located in the customer’s country, but first routes it through a chain of anonymization servers called the “CNC Anonymization Network” to shield the operator from detection via the initial attack link. To bypass the need for targets to manually click links, Intellexa has developed alternative methods to trigger infections. The company also created a sophisticated vector called “Aladdin,” which exploits the global mobile advertising ecosystem to enable silent, zero-click infections on devices anywhere in the world.
Intellexa, a surveillance firm specializing in spyware sales to governments, has operated with limited transparency, the report noted, with its internal workings largely opaque to outside researchers until now.
Amnesty International had previously posed detailed questions to Intellexa about its products, operations and corporate structure, but the company declined to respond.The firm has faced regulatory backlash before. In 2023, the Greek Data Protection Authority fined Intellexa for noncooperation in investigations into its activities.
Separately, Google has begun notifying several hundred users across multiple countries, including Pakistan, that their accounts were targeted by Predator spyware, further corroborating the tool’s active deployment. The revelations come amid growing international concern over commercial spyware’s role in enabling authoritarian surveillance and human rights abuses. Predator has been linked to such violations in several nations, though the report did not specify which ones beyond the broader pattern.
In Pakistan, where civil liberties groups have long warned of digital threats to activists and journalists, the emergence of Predator raises alarms about foreign technology infiltrating local security apparatuses. Balochistan, the lawyer’s base, has been a hotspot for insurgency and state crackdowns, making human rights defenders particularly vulnerable.
Copyright © 2021 Independent Pakistan | All rights reserved
