Intellexa, a sanctioned spyware maker, had direct access to government espionage victims, according to researchers.

New findings from Amnesty International indicate that spyware company Intellexa could remotely access certain surveillance systems of its government clients, potentially allowing employees to view sensitive personal information from phones infected with its Predator spyware.

On Thursday, Amnesty, together with media partners including Israeli outlet Haaretz, Greek site Inside Story, and Swiss publication Inside IT, released a series of reports based on leaked Intellexa materials. These included internal documents, marketing resources, and training videos.

The most concerning discovery is that Intellexa personnel may have connected to clients surveillance systems through TeamViewer, a standard tool for remote computer access. Leaked training footage appears to show privileged areas of the Predator system, including a dashboard and storage containing photos, messages, and other collected data.

Amnesty noted that the video seems to document active infection attempts on real targets, including one in Kazakhstan, displaying URLs, IP addresses, and phone software versions. Screenshots reveal the type of data accessible to both clients and Intellexa support staff.

Spyware companies like NSO Group and Hacking Team have traditionally stated they do not access customer data to avoid legal risk and maintain that responsibility lies with the customer. Governments also generally avoid granting private firms visibility into sensitive investigations.

Paolo Lezzi, CEO of Memento Labs, described such remote access as highly unusual and suggested the footage could depict a demonstration rather than a live system. Some companies permit temporary remote access only under supervised technical support conditions.

Amnesty, however, asserts the footage depicts actual customer systems. One of the staff asked if it was a demo environment, and the instructor confirmed it was a live system, said Donncha Cearbhaill, head of Amnestys security lab.

The report raises serious privacy concerns, as victims most sensitive information may be exposed not only to government clients but also to Intellexa itself. The organization warned that the company has shown vulnerabilities in safeguarding confidential data.

Intellexa has not responded publicly. A lawyer representing founder Tal Dilian stated he has not committed any crime nor operated any cyber system in Greece or elsewhere. Dilian has been described as operating recklessly within the spyware industry.

In 2024, the U.S. government imposed sanctions on Tal Dilian and business partner Sara Aleksandra Fayssal Hamou, citing Intellexas spyware being used against Americans, including government officials and journalists. The sanctions prohibit U.S. entities from any commercial dealings with the individuals.

Dilian dismissed the reports as part of a media campaign aimed at harming him and his company.

Author: Gavin Porter