Predator is a commercial surveillance tool sold to government clients by the Intellexa alliance, a consortium of companies linked to former Israeli intelligence officer Tal Dilian and incorporated across jurisdictions including Greece, Cyprus, Ireland, North Macedonia, and Hungary. Once deployed, Predator can read messages, harvest contacts and files, log keystrokes, track location, and silently turn on the device's microphone and camera.
Predator typically reaches targets through one of two delivery paths: a one-click link sent via SMS, WhatsApp, or email, or a network injection attack in which a target's mobile traffic is rerouted by a cooperating telecom or a local tactical device to a malicious server. Researchers at Google's Threat Analysis Group and Citizen Lab have documented Predator exploiting chains of zero-day vulnerabilities in iOS and Android, including a chain disclosed in 2023 affecting iPhones running iOS 16.
Predator gained global attention through the "Predatorgate" scandal in Greece (2022), in which journalist Thanasis Koukakis and opposition PASOK leader Nikos Androulakis were found to have been targeted, triggering investigations by the European Parliament's PEGA Committee into spyware abuses across the EU. Citizen Lab, Amnesty International's Security Lab, and the European Investigative Collaborations consortium (in the "Predator Files," 2023) have since documented suspected Predator customers in countries including Egypt, Saudi Arabia, Madagascar, Sudan, Vietnam, and Indonesia.
In July 2023, the U.S. Department of Commerce added Intellexa and Cytrox entities to its Entity List, and in March 2024 the U.S. Treasury's OFAC imposed sanctions on Intellexa founder Tal Dilian and associated companies — the first time the U.S. used financial sanctions against a commercial spyware vendor. Predator is frequently compared to NSO Group's Pegasus and is a central case study in debates over export controls, dual-use technology, and the legal regulation of the commercial spyware industry.
Example
In 2022, forensic analysis by Citizen Lab and Greek authorities confirmed that PASOK leader Nikos Androulakis had been targeted with a Predator infection attempt, igniting Greece's "Predatorgate" political scandal.
Frequently asked questions
Predator is developed and sold by the Intellexa alliance, a group of interlinked companies including Cytrox, associated with former Israeli intelligence officer Tal Dilian.
Keep learning