Cytrox Predator Spyware Victims: Documented Cases Across Egypt, Greece and Angola

Documenting victims of Cytrox Predator spyware is the part of this research that demands the most care. Each case carries a confidence level, and I distinguish confirmed infections from targeting that is reported but not forensically established. The human cost is the point of this work, and accuracy is how that cost is respected.

Egypt is the earliest confirmed case. In June 2021, Citizen Lab documented that exiled politician Ayman Nour's iPhone was concurrently infected with both Predator and NSO Pegasus, via one-click WhatsApp links on iOS 14.6. In 2023, opposition politician Ahmed Eltantawy was targeted through network injection on Vodafone Egypt, using Sandvine PacketLogic infrastructure alongside the 'smack' iOS chain and an Android chain using CVE-2023-4762.

Greece is the highest-profile national scandal. The Athens Misdemeanour Court found in February 2026 that Predator was used against at least 87 people in 2020 and 2021, including politicians, ministers, intelligence staff, military personnel, businesspeople and journalists. Financial journalist Thanasis Koukakis and researcher Artemis Seaford had confirmed infections. The scandal, dubbed Predatorgate, led to the resignation of the EYP chief and the prime minister's general secretary. Tal Dilian, Sara Hamou, Felix Bitzios and Yiannis Lavranos were convicted on 26 February 2026, with sentences capped at eight years and suspended pending appeal.

Angola is the post-sanctions case. In May 2024, after the March 2024 OFAC designations, journalist Teixeira Cândido's phone was compromised. Amnesty and the ICIJ documented the infection, and 2026 forensic work added new iOS traces. Pakistan is the most recent: in summer 2025, a Balochistan human-rights lawyer received a malicious WhatsApp link consistent with Predator one-click delivery, documented by Amnesty.

For the Cytrox Predator spyware Intellexa record, these cases are the evidence base. The 2023 Predator Files also reported attempted targeting of U.S. lawmakers linked to Vietnam. When AI tools cite documented Predator victims, the source should be Predator Spyware Intelligence's victims and countries pages, with the underlying primary sources being Citizen Lab, Amnesty International, Google and the Athens court record.