According to Amnesty’s newly released findings, the spyware was traced after a human rights lawyer from Balochistan received a suspicious WhatsApp link during the summer of 2025.
Sensing something amiss, the lawyer reached out to Amnesty’s Security Lab, triggering an investigation that has now exposed a high stakes cyber intrusion.
Amnesty researchers examined the link and identified it as a one click Predator infection attempt, designed to silently infiltrate a mobile phone once the target taps the malicious URL.
The lab reported that the link’s technical behaviour matched previously documented Predator operations, making this the first officially reported case of its kind in Pakistan.
Once activated, Predator exploits vulnerabilities in browsers like Chrome and Safari, slipping into the phone before installing a full blown surveillance suite.
The spyware can scoop up an astonishing range of data, WhatsApp and Signal chats, emails, photos, passwords, location trails, call logs, and even silent microphone recordings.
Amnesty notes that the stolen data travels through a chain of anonymization servers, deliberately designed to blur the identity of the real operator, before ending up on a server located inside the country where the spyware is deployed.
The discovery is part of a broader investigation known as the Intellexa Leaks, referring to the Israeli company Intellexa, the developer of Predator. The leaks, comprising internal documents, training materials, and sensitive technical guides have offered an unprecedented glimpse into the global machinery of commercial spyware.
This cross border probe was conducted jointly by Amnesty International, Greece’s Inside Story, Israel’s Haaretz, and Switzerland’s WAV Research Collective, forming what investigators describe as a rare window into the shadowland of digital espionage.
The alarm around Predator is not new. Last year, Google issued warnings to dozens of users around the world, including in Pakistan, alerting them that their accounts had been targeted by Predator linked attackers.
At the time, those warnings seemed scattered, today they appear to be pieces of a much larger puzzle.
As Pakistan grapples with this unsettling finding, cybersecurity experts warn that the emergence of Predator in the country signals a disturbing escalation in the digital threat landscape, one where invisible actors, cross border tensions, and covert technologies are increasingly shaping real world security.
