Spyware maker Intellexa had direct remote access to some government customers’ surveillance systems, allowing its staff to view personal data collected from hacked phones, according to new findings published by Amnesty International and several media partners.
Leaked materials detail internal access to surveillance systems
Amnesty International on Thursday released reports based on leaked Intellexa materials, including internal documents, sales and marketing files, and training videos. The reporting was conducted alongside Israeli newspaper Haaretz, Greek outlet Inside Story, and Swiss publication Inside IT.
One leaked training video shows Intellexa staff allegedly connecting remotely to customer surveillance systems using TeamViewer, a commercial remote access tool. Amnesty said this enabled personnel to access the Predator spyware dashboard and a storage system containing photos, messages, and other surveillance data collected from victims.
Amnesty published screenshots from the video but not the full recording. The nonprofit said the footage shows “live” Predator infection attempts involving real targets, including a case in Kazakhstan. The material included the infection link, the target’s IP address, and the software versions running on the target’s phone.
Industry norms oppose vendor access to customer systems
Companies that sell spyware to governments have long maintained that they do not have access to their customers’ systems or to data collected from surveillance targets. This separation is meant to limit legal exposure for vendors and to protect the confidentiality of government investigations.
Paolo Lezzi, chief executive of spyware company Memento Labs, told TechCrunch that such constant remote access would not normally be accepted by government agencies. He said customers would only allow temporary access under supervision for technical support purposes.
Lezzi questioned whether the leaked footage showed a real customer environment or a demonstration system. Amnesty rejected that interpretation.
Donncha Ó Cearbhaill, head of Amnesty’s Security Lab, said one person in the training call asked whether the system was a demo environment, and the instructor confirmed that it was a live customer system.
Privacy and security implications for surveillance targets
Amnesty said the alleged access raises additional privacy and security risks for people targeted with the Predator spyware.
The nonprofit said victims’ data could be exposed not only to the government customer but also to a foreign private surveillance company that has demonstrated difficulties in safeguarding sensitive information.
“These findings can only add to the concerns of potential surveillance victims,” Amnesty wrote.
Sanctions and legal context surrounding Intellexa leadership
Intellexa could not be reached for comment. A lawyer representing Intellexa founder Tal Dilian told Haaretz that Dilian has “not committed any crime nor operated any cyber system in Greece or anywhere else.”
Dilian has been a controversial figure in the spyware industry. In 2024, the U.S. government imposed sanctions on Dilian and his business partner Sara Aleksandra Fayssal Hamou. The U.S. Treasury said Intellexa spyware had allegedly been used against Americans, including government officials, journalists, and policy experts.
The sanctions prohibit U.S. companies and nationals from engaging in business with Dilian and Hamou. This marked the first time the U.S. government sanctioned an individual tied to the commercial spyware sector, after earlier actions against spyware maker NSO Group.
Founder disputes allegations
In comments to Haaretz, Dilian accused journalists of participating in what he described as an orchestrated campaign to damage him and Intellexa, which he said was “fed into the Biden administration.”
A former spyware industry executive previously told TechCrunch that Dilian operated with little effort to conceal his activities, characterizing his approach as highly visible within the industry.
Featured image credits: Freepik
For more stories like it, click the +Follow button at the top of this page to follow us.