Predator in Egypt Intellexa Leaks Expose State Spyware Operations Against Activists

• .What: Predator spyware deployed against Egyptian dissidents via zero-click exploits.
• .Who: Political activists, journalists, and opposition figure Ayman Nour.
• .Data Exposed: Full device access including calls, messages, camera, microphone, and location.
• .Outcome: US sanctions on Intellexa; Greek court convicted Intellexa executives.

In December 2025, Amnesty International's Security Lab published the results of its "Intellexa Leaks" investigation, a forensic analysis based on internal corporate documents, infrastructure mapping, and device analysis of confirmed targets.

The investigation established that Predator spyware - developed and sold by the Intellexa consortium, a network of surveillance technology companies operating across multiple EU jurisdictions - had been systematically deployed against Egyptian political dissidents, journalists, and activists.

Among the confirmed targets was Ayman Nour, a prominent Egyptian opposition politician and former presidential candidate.

Forensic examination of Nour's device revealed artifacts consistent with a Predator infection delivered via an ad-injection vector exploiting CVE-2023-41993, a vulnerability in Safari's JSKit (JavaScriptCore) framework.

This delivery mechanism requires no user interaction - the target does not need to click a link, open a file, or take any action.

The spyware is injected through the advertising infrastructure that serves content to the target's browser during normal web browsing, making traditional security awareness guidance ("do not click suspicious links") entirely irrelevant against this attack class.

Once installed, Predator provides complete device takeover: real-time access to encrypted messaging applications including Signal, WhatsApp, and Telegram, email capture, password extraction, continuous GPS location tracking, screenshot capture, and remote activation of the device's microphone and camera.

Google's Threat Analysis Group identified "several hundred accounts" targeted by Predator across Egypt, Pakistan, Kazakhstan, and other countries. The Greek judiciary convicted Intellexa executives in connection with the surveillance operations.

The U.S. Treasury's Office of Foreign Assets Control (OFAC) imposed sanctions on Intellexa entities and associated individuals, designating them for involvement in activities that threaten the privacy and security of individuals and organizations worldwide.

Predator provides complete device takeover: access to encrypted messaging apps (Signal, WhatsApp, Telegram), email capture, password extraction, continuous GPS tracking, screenshots, and microphone/camera activation.

Delivered via ad-injection using CVE-2023-41993 in Safari's JSKit framework - completely bypassing "don't click suspicious links" guidance.

Greek court convicted Intellexa executives. US OFAC sanctions on Intellexa entities. Google's Threat Analysis Group warned of "several hundred accounts" targeted across Egypt, Pakistan, Kazakhstan, and other countries.

Egypt's Law 175/2018 (Anti-Cyber Crimes) and Law 151/2020 (Data Protection) provide no meaningful protection against state-directed surveillance. The entity conducting the surveillance is the same entity responsible for enforcing the laws.

Predator spyware operates at a level of sophistication that renders conventional endpoint security controls insufficient. The zero-click delivery mechanism exploiting CVE-2023-41993 requires no user interaction and bypasses every behavioral defense predicated on user vigilance.

This is not a phishing email that a trained user can recognize and delete. It is a weaponized advertisement served through legitimate infrastructure during routine browsing.

The controls that can mitigate this threat class operate at the device, network, and operational security layers - and they must be understood as risk reduction, not elimination, against a state-backed adversary deploying million-dollar surveillance toolkits.

The primary technical defense against zero-click mobile exploits is aggressive operating system patching.

CVE-2023-41993 was patched by Apple in September 2023. Devices running current iOS and Android versions with all security updates applied close the specific vulnerability exploited by this Predator variant.

However, commercial spyware vendors maintain arsenals of zero-day exploits, meaning patching eliminates known vectors but not unknown ones.

Apple's Lockdown Mode - available on iOS 16 and later - provides the most effective device-level mitigation by disabling attack surfaces that spyware vendors exploit: it blocks most message attachment types, disables link previews, restricts web browsing features including just-in-time JavaScript compilation, and prevents installation of configuration profiles.

For individuals at elevated risk of state-sponsored targeting, Lockdown Mode is the single most impactful control available.

The difference between running Lockdown Mode and not running it is the difference between a device that presents a reduced attack surface and a device that accepts weaponized advertisements without restriction.

Network-level detection provides a second layer. Predator communicates with command-and-control infrastructure for data exfiltration and operator instructions.

Mobile Threat Defense (MTD) solutions from Lookout, Zimperium, or CrowdStrike Falcon for Mobile detect anomalous network connections, certificate anomalies, and traffic patterns consistent with spyware communication.

DNS filtering through Quad9, Cloudflare Gateway, or Cisco Umbrella can block connections to known Predator infrastructure domains identified by Citizen Lab and Amnesty International's Security Lab.

These are not perfect defenses against a well-resourced adversary that rotates infrastructure, but they impose cost and friction on the surveillance operation.

Operational security practices provide the third layer. Individuals at risk of state-sponsored surveillance must compartmentalize sensitive communications from devices that may be compromised.

Dedicated devices used exclusively for sensitive communications - purchased anonymously, connected only through VPN services, and never associated with the target's identity - create a separation between the device the adversary targets and the device carrying sensitive information.

This is the standard operational practice recommended by organizations like the Committee to Protect Journalists and Access Now for journalists and activists operating in surveillance-intensive environments.

Physical indicators of compromise include unexplained battery drain, excessive data usage, device overheating during idle periods, and spontaneous microphone or camera activation.

The regulatory dimension of this case is unique. Egypt's Law 175/2018 and Law 151/2020 ostensibly protect citizens from unauthorized data access. In practice, the entity deploying Predator against Egyptian citizens is the same entity responsible for enforcing those laws.

Domestic legal frameworks provide no protection when the state itself is the threat actor. International accountability mechanisms - the kind that produced Greek criminal convictions and U.S. OFAC sanctions against Intellexa - are the only functioning enforcement channel.

The EU's proposed regulation on the export of cyber-surveillance technologies and the Pall Mall Process commitments represent emerging frameworks, but effective enforcement against the commercial spyware industry requires export controls with teeth, personal liability for executives, and extraterritorial jurisdiction over companies that sell surveillance tools to governments that use them against their own citizens.

Amnesty International Security Lab, The Hacker News, CyberScoop, Malwarebytes, Google TAG, Egypt Law 175/2018, Egypt Law 151/2020