European Spyware Scandals Involving Predator and Paragon Targeting Journalists and Civil Society
A Greek court sentenced four Intellexa executives to eight years in prison for their role in the “Predatorgate” spyware scandal, which involved use of Predator spyware against 90+ public figures. Prior investigations by The Citizen Lab and others documented Predator’s presence in Greece and confirmed infections on devices belonging to journalist Thanasis Koukakis and former Meta trust-and-safety manager Artemis Seaford, marking a rare case where executives at a mercenary spyware firm faced criminal conviction and prison time.
In Italy, prosecutors in Rome and Naples confirmed via a technical report that journalist Francesco Cancellato and immigration activists Giuseppe Caccia and Luca Casarini showed traces consistent with Paragon Solutions spyware infections during the early hours of 2024-12-14, suggesting a coordinated infection campaign. Italian authorities also inspected a Paragon spyware server used by the intelligence agency AISI and found evidence of operations against Caccia and Casarini but not against Cancellato, leaving attribution for Cancellato’s compromise unresolved; the case follows WhatsApp notifications to roughly 90 people warning they were targeted with Paragon spyware.
Get ahead of threats like this
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
How this story unfolded
10 events from the most recent confirmed update back to the earliest known activity.
Rights groups confirm Predator surveillance of Angolan journalist
Reporter ohne Grenzen and Amnesty International said they confirmed that Angolan journalist Teixeira Cândido was hacked and surveilled with Intellexa’s Predator spyware. The report also links the spyware’s sale in Angola to the intelligence service SINSE through leaked commercial documentation.
Greek court sentences four Intellexa executives to prison
A Greek court sentenced four Intellexa executives, including the company's founder, to eight years in prison over their role in the Predator spyware scandal. Citizen Lab described it as the first known prison sentence for executives of a mercenary spyware company.
Italian prosecutors confirm spyware traces on Cancellato and activists
Prosecutors in Rome and Naples confirmed through a technical report that Francesco Cancellato, Giuseppe Caccia, and Luca Casarini showed traces of spyware infection, while attribution for Cancellato remained unresolved.
Paragon reportedly cancels Italian government contracts
Amid the widening spyware controversy in Europe, Paragon reportedly canceled its contracts with the Italian government.
COPASIR inquiry finds lawful targeting of two Italian activists
A June 2025 COPASIR inquiry concluded that Italian intelligence lawfully targeted Giuseppe Caccia and Luca Casarini, but found no evidence explaining the compromise of Francesco Cancellato.
WhatsApp warns about 90 Paragon-linked spyware targets
In January 2025, WhatsApp warned Francesco Cancellato and about 90 others that they had been targeted in a campaign linked to Paragon Solutions' spyware.
Paragon spyware infections hit Italian journalist and activists
A technical report later found traces of spyware infection on journalist Francesco Cancellato and immigration activists Giuseppe Caccia and Luca Casarini in the early hours of December 14, 2024, indicating a coordinated campaign.
Citizen Lab confirms Predator infections on Koukakis and Seaford phones
Citizen Lab later confirmed Predator spyware infections on the phones of journalist Thanasis Koukakis and former Meta trust and safety manager Artemis Seaford.
Predator spyware scandal targets more than 90 public figures in Greece
In 2022, the Predatorgate scandal emerged in Greece involving the targeting of more than 90 public figures with Predator spyware.
Citizen Lab publishes evidence of Predator spyware activity in Greece
Citizen Lab first published evidence of Predator spyware activity in Greece, helping expose what later became known as the Predatorgate scandal.
Related entities
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Sources
4 references tracked. Mallory keeps watching after this page renders.
Staatstrojaner in Angola: Ehemaliger FinFisher-Manager vertreibt weiter Spionagewerkzeuge
netzpolitik.org
Open sourceEen bom, machtige mediamagnaten en lasterzaken: journalisten in Italië krijgen het steeds moeilijker - NRC
nrc.nl
Open sourceIntellexa Founder, Three Others Sentenced to 8 Years in Prison Over Greek Spyware Scandal - The Citizen Lab
citizenlab.ca
Open sourceItalian prosecutors confirm journalist was hacked with Paragon spyware | TechCrunch
techcrunch.com
Open sourceSee the full picture, correlated to your attack surface.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Related stories
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Paragon Graphite Spyware Scandal Deepens in Italy
Italian prosecutors are investigating a spyware scandal after **WhatsApp** and **Apple** alerted journalists, activists, and NGO workers that they had been targeted with mercenary spyware linked to **Paragon Solutions’ Graphite** platform. The campaign reportedly affected about 90 people worldwide, and public disclosures in Italy included journalist **Francesco Cancellato**, Fanpage journalist **Ciro Pellegrino**, and Mediterranea Saving Humans figures **Luca Casarini** and **Beppe Caccia**. Researchers at **Citizen Lab** later confirmed infections of Pellegrino and another European journalist, tying one case to a sophisticated zero-click **iMessage** exploit that Apple said was mitigated in `iOS 18.3.1`. The case has intensified scrutiny of Italy’s intelligence services after a parliamentary committee said agencies **AISI** and **AISE** were Paragon customers, even as the government denied targeting legally protected subjects such as journalists. Paragon said it had offered help investigating the alleged surveillance and later cut ties with Italy, but prosecutors in Rome and Naples reportedly have not received the company’s cooperation through formal channels, raising questions about accountability and Israeli assistance in spyware investigations. The dispute echoes earlier battles over Israeli spyware vendors, including **NSO Group’s Pegasus**, which was previously used in WhatsApp-based attacks and became the subject of major litigation and international scrutiny.
May 26, 2026
Predator Spyware Campaigns Spur Sanctions and Convictions Tied to Intellexa
Investigations by Amnesty International, media partners, and other researchers linked the **Predator** mercenary spyware ecosystem to campaigns targeting politicians, journalists, civil society figures, and officials across multiple countries. One probe found suspected Vietnamese government-linked operators used malicious X posts and fake news links in an attempt to infect the phones of U.S. lawmakers and journalists, including members of Congress and reporters covering national security and Taiwan. Separate reporting tied Predator to earlier abuses in Greece and elsewhere, while technical analysis showed the malware could exploit multiple zero-days, pair with the **Alien** component for persistence, and steal messages, record calls, and activate device microphones. The widening scandal triggered government action and court cases against the spyware network behind Predator. The United States blacklisted Intellexa and Cytrox and later imposed additional sanctions on Intellexa, citing national security risks from the commercial surveillance trade. In Greece, courts convicted executives in the Predator wiretapping case, including an Israeli spyware maker who received an eight-year sentence, while Amnesty continued to document new alleged targeting, including a journalist in Angola and further evidence from the **"Intellexa Leaks"** that the spyware industry remained active despite mounting scrutiny.
May 26, 2026
Intellexa Executives Sentenced in Greece Over Predator Spyware Wiretapping Scandal
A Greek court in Athens sentenced **Intellexa** founder **Tal Dilian** and three associates—**Sara Hamou**, **Felix Bitzios**, and **Yiannis Lavranos**—to prison for their roles in the “Greek Watergate” spyware scandal involving illegal wiretapping and privacy violations tied to Intellexa’s *Predator* spyware. Local reporting cited by multiple outlets indicates the court imposed sentences totaling more than **126 years**, which under Greek law translate to **eight years** to be served; the court also ordered further investigation, and the defendants are expected to **appeal** and remain free pending the appeal process. The case stems from allegations that *Predator* was used to surveil Greek targets including **politicians, journalists, businesspeople, military officials, and other public figures**, with reporting citing **more than 90** victims in Greece during **2020–2021**. Lavranos’s company **Krikel** was reported to have links to the procurement of *Predator*. The convictions mark a notable legal milestone against a commercial spyware vendor; Intellexa and associated entities have also faced international scrutiny, including **U.S. sanctions** in 2024 over alleged misuse of the spyware, and experts noted the guilty verdict and custodial sentence could increase cross-border legal exposure even if defendants attempt to avoid Greek jurisdiction.
Mar 25, 2026