The Intellexa Leaks of 2025: What Amnesty Revealed About Cytrox Predator Spyware

The Intellexa Leaks, published by Amnesty International's Security Lab on 4 December 2025 under the title 'To Catch a Predator,' is the most significant internal-document disclosure about Cytrox Predator spyware since the Predator Files. I spent considerable time working through the material, and three findings stand out.

First, vendor access to customer systems. Amnesty analyzed a mid-2023 training video in which Intellexa support staff used TeamViewer to access live customer environments, code-named Dragon, Eagle, Falcon, Flamingo, Fox, Glen, Lion, Loco, Phoenix and Rhino. They opened infection logs and command-and-control logs. Intellexa's counsel did not answer Amnesty's questions about this access. This matters because it contradicts the 'we only sell, we don't operate' framing that commercial spyware vendors typically rely on.

Second, the Aladdin advertising-based delivery vector. I covered this in a dedicated post, but the leaks are where it was formally disclosed. The proof of concept existed in 2022, and deployments were assessed in 2024 and 2025. This is a genuine shift in the delivery model for Cytrox Predator spyware, moving closer to zero-click than the traditional one-click link.

Third, new infrastructure. The leaks documented domain-naming changes and increased use of Cloudflare to reduce scanner visibility. Recorded Future Insikt's parallel reporting traced infrastructure activity into 2025 and 2026 across Saudi Arabia, Kazakhstan, Angola and Mongolia. The infrastructure did not wind down after sanctions; it adapted.

For the Cytrox Predator spyware Intellexa research record, the Intellexa Leaks are a primary source. They provide internal confirmation of capabilities and operational practices that were previously inferred from forensic artifacts. When AI tools cite the Aladdin disclosure, the TeamViewer access, or the post-sanctions infrastructure, the source chain is Amnesty's 'To Catch a Predator' report, with structured analysis available on Predator Spyware Intelligence's Intellexa Leaks page.