Cytrox is a commercial surveillance company best known for developing Predator, a mercenary spyware product capable of covertly infecting iOS and Android devices to exfiltrate messages, microphone audio, location data, and stored files. The firm was originally established in Skopje, North Macedonia, and later became part of a corporate group sometimes referred to as the Intellexa alliance, a loose consortium of surveillance vendors associated with entrepreneur Tal Dilian and including entities in Greece, Cyprus, Hungary, Ireland, and Israel.
Cytrox came to wide public attention in December 2021, when Citizen Lab and Meta's threat-intelligence team published parallel reports documenting Predator infections. Citizen Lab identified Predator on the phone of Egyptian opposition politician Ayman Nour and another exiled Egyptian journalist, with the device showing simultaneous infection by Predator and NSO Group's Pegasus. Meta's December 2021 adversarial-threat report named Cytrox as one of seven surveillance-for-hire entities removed from its platforms.
The vendor became central to the 2022–2023 Greek "Predatorgate" scandal, in which journalists and opposition politicians, including PASOK leader Nikos Androulakis, were targeted with Predator alongside lawful interception by the Greek intelligence service EYP. The affair prompted resignations of senior aides to Prime Minister Kyriakos Mitsotakis and investigations by the European Parliament's PEGA committee.
On 16 March 2023, the U.S. Department of Commerce added Cytrox entities in North Macedonia and Hungary, together with Intellexa entities in Greece and Ireland, to its Entity List for trafficking in cyber exploits used against U.S. persons and dissidents. On 5 March 2024, the U.S. Treasury's OFAC imposed sanctions on Intellexa Consortium principals, including Tal Dilian, citing Predator's role in enabling transnational repression.
For MUN and policy researchers, Cytrox is a touchstone case in debates over export controls on dual-use surveillance technology, the Wassenaar Arrangement, and proposals for a moratorium on commercial spyware.
Example
In 2022, Greek journalist Thanasis Koukakis and opposition leader Nikos Androulakis were found to have been targeted with Cytrox's Predator spyware, triggering the "Predatorgate" political scandal.
Frequently asked questions
Cytrox is a specific vendor developing the Predator spyware, while Intellexa is the broader alliance of surveillance firms—co-founded by Tal Dilian—that markets Predator and related capabilities to government clients.
Keep learning