{"id":16665,"date":"2026-02-09T18:08:03","date_gmt":"2026-02-09T16:08:03","guid":{"rendered":"https:\/\/zawia3.com\/?p=16665"},"modified":"2026-10-24T16:51:18","modified_gmt":"2026-10-24T14:51:18","slug":"spy-companies","status":"publish","type":"post","link":"https:\/\/zawia3.com\/en\/spy-companies\/","title":{"rendered":"A Warning from the Buyer: Egypt Flags Israeli Spyware It Paid Millions to Use"},"content":{"rendered":"

On 9 December last year, Egypt’s National Telecommunications Regulatory Authority, represented by the Egyptian Computer Emergency Readiness Team (EG-CERT), issued an urgent<\/span> warning<\/span><\/a> to citizens about advanced hacking attempts targeting smartphone users in more than 150 countries around the world, including Egypt. It noted that these attempts rely on exploiting previously unknown vulnerabilities (zero-day vulnerabilities), in addition to sending malicious links and messages that appear to come from trusted parties.<\/span><\/p>\n

The warning coincided with<\/span> reports<\/span><\/a> by Google and Apple about sophisticated commercial spyware such as “Predator”, belonging to the Israeli company “Intellexa”, which has been subjected to American<\/span> sanctions<\/span><\/a> because of the threat it poses to global cybersecurity.<\/span><\/p>\n

Intellexa is one of the best-known “mercenary” spyware companies<\/a>, a term used by civil society and industry researchers to describe private entities that develop spyware and sell it to governments.<\/p>\n

The irony is that the Egyptian authorities had previously cooperated with the same company, during the period (2019\u20132021), to use specific software such as (<\/span>Predator) to monitor a group of activists, politicians and human rights defenders, according to a set of technical investigations conducted<\/a> by Amnesty International in cooperation with other international organisations.<\/p><\/blockquote>\n

\"\"<\/p>\n

<\/span>A subsequent<\/span> investigation<\/span><\/a> conducted by Amnesty International in cooperation with (<\/span>nside Story<\/span><\/a> <\/span>Haaretz<\/span><\/a> and <\/span>WAV Research Collective<\/span><\/a> ) revealed evidence indicating that Intellexa had the ability to remotely access the systems of Predator’s clients, even those physically located at the premises of its government clients. Consequently, Intellexa was able to access the data of people subjected to targeted surveillance attacks by governments.<\/span><\/p>\n

The most serious dimension that the investigations<\/span> revealed<\/span><\/a>, in addition to documents leaked from inside the company, is that “Intellexa” has the ability to remotely access the systems of Predator’s clients, even those physically located at the premises of its government clients. Consequently, Intellexa was able to access the data of people subjected to targeted surveillance attacks by governments.<\/span><\/p>\n

\"Screenshot
Screenshot of a leaked document showing “Aladdin”, a zero-click infection system through a malicious advertisement that relies on the public IP address\/ Amnesty International.<\/figcaption><\/figure>\n

 <\/p>\n

The leaked<\/span> files<\/span><\/a>, which cover a large part of the company’s recent history, contain additional technical evidence confirming, through digital forensic evidence, that the Predator spyware, Intellexa’s main programme, was used in specific cases of surveillance abuses previously documented in Greece and Egypt.<\/span><\/p>\n

\"Screenshot
Screenshot of a leaked internal training video showing the Elasticsearch logging interface, which contains logs and information from the live Predator system\/ Amnesty International<\/figcaption><\/figure>\n

 <\/p>\n

In this context, Mahmoud Shalaby, Amnesty International’s researcher on Egypt and Libya, affirms that in recent years the organisation has documented the use of commercial spyware and digital attacks in Egypt against human rights defenders, journalists and political activists.<\/p>\n

Shalaby cites, for example, the use of the Predator spyware belonging to the “Intellexa” alliance in campaigns linked to Egypt, in addition to the organisation obtaining digital forensic evidence dating back to 2020 and 2021, which included the targeting of opposition figures and journalists.<\/p><\/blockquote>\n

In addition, the investigations of the “Pegasus” Project in 2021 showed that phone numbers belonging to Egyptian activists and journalists were on potential lists for targeting with the Pegasus programme. Shalaby explains that the organisation discovered that in 2019 hundreds of people, among them human rights defenders at Egyptian civil society organisations, were subjected to a cyberattack in which they received emails that were attempts to gain access to the targeted persons’ email accounts, through a form of phishing known as OAuth (OAuth Phishing).<\/span><\/p>\n

All of these illegal practices constitute a broad violation of people’s right to privacy, according to Shalaby, and the Egyptian government has used them to stifle the public sphere in the country and to create a state of self-censorship by tracking and intimidating human rights defenders, journalists and anyone who might be engaged in the public sphere.<\/span><\/p>\n

 <\/p>\n


\nWho Is Watching Egyptians?<\/b><\/h1>\n

In recent years, Egypt has faced growing human rights<\/span> criticism<\/span><\/a> over the<\/span> expansion<\/span><\/a> of digital and legal surveillance tools that infringe on citizens’ privacy and freedom of expression, particularly via phones, the internet and social media networks, in addition to the blocking of news websites.<\/span><\/p>\n

Despite this, last year the House of Representatives<\/span> approved<\/span><\/a> new amendments to the Criminal Procedure Law that allow the Public Prosecution, after a reasoned authorisation from a summary judge, to monitor wired and wireless communications, social media accounts, email, and text, voice or video messages on phones and technical devices, to seize the media containing them, or to record private conversations, on condition that the felony or misdemeanour is punishable by imprisonment of more than 3 months, with a maximum duration of 30 days, renewable.<\/span><\/p>\n

A review and tracking of the surveillance systems acquired by the Egyptian authorities since 2013 shows a clear pattern of systematic expansion in the<\/span> purchase<\/span><\/a> of technologies for the<\/span> interception<\/span><\/a> of communications and for digital espionage from American, French, Italian and Israeli<\/span> companies<\/span><\/a>.<\/span><\/p>\n

These<\/span> systems<\/span><\/a>, which<\/span> included<\/span><\/a> (ProxySG, Vortex, Cortex, Remote Control System, Pegasus and Cerebro), were not limited to monitoring public content, but<\/span> enabled<\/span><\/a> the hacking of personal devices, the activation of cameras and microphones, the interception of encrypted communications, and the analysis of user behaviour on a wide scale.<\/span><\/p>\n