Predator Spyware Continues Operating Post-Sanction via Intellexa Consortium Shell

The Record (citing unnamed sources) reports that Predator spyware, manufactured by the Intellexa Consortium, infected the phone of an Angolan journalist in 2026. The Intellexa Consortium was added to the U.S. Entity List in July 2023, which should have blocked its operations, yet the incident suggests the organization continues functioning through undisclosed channels.

Entity List enforcement gaps directly weaken export control architecture. If Intellexa retained operational capability through structural loopholes rather than technical sophistication, the same vulnerabilities likely apply to other sanctioned surveillance and telecommunications vendors (NSO Group, Candiru, others on the Commerce and Treasury lists). This forces the U.S.

Intelligence Community to reassess which foreign intelligence services still have access to commercial spyware tools it believed it had denied — a counterintelligence problem that may require either secondary sanctions (Treasury OFAC designations targeting financiers and customers) or technical countermeasures (NSA/CISA hardening guidance for allied governments).

WHY IT MATTERS

This is the first public evidence that Intellexa has maintained operational capability after U.S. sanctions — a critical gap in enforcement.

If confirmed, it demonstrates that Entity List designations alone do not disable commercial spyware operations, particularly when the manufacturer operates through distributed or shell structures. For defense and intelligence officials, this signals either inadequate post-sanction monitoring or the need for secondary enforcement mechanisms (financial sanctions, travel bans, component interdiction).

For commercial entities in the surveillance space, it suggests reputational and legal risk persists even after official designation.

The key variable is whether Intellexa's continued operation traces to a specific technical or financial loophole (e.g., offshore subsidiaries, component sourcing) or reflects broader enforcement failure — the former is fixable, the latter implies dozens of other sanctioned entities may remain active.

Predator Spyware Continues Operating Post-Sanction via Intellexa Consortium Shell

Fault Lines