Spyware Sanctions Collapse While the Surveillance Industry Pivots

In May 2024, a phone belonging to Teixeira Candido — a prominent Angolan journalist who has spent years reporting on corruption in Luanda — was infected with surveillance software for a brief window. The spyware streamed his camera and microphone feeds to operators he never saw, recording indicators his iPhone was supposed to display. Candido only learned of the infection months later, after researchers at Amnesty International's Security Lab conducted a forensic examination of his device. The tool that breached his phone was Predator, a product of the Greece-based surveillance vendor Intellexa. Candido is not an outlier. He is the median case.

Predator is a commercial-grade intrusion tool — one of several competing in a global market that has, over the past half-decade, transformed from a niche intelligence-community supply chain into a sprawling, semi-visible industry. Intellexa, NSO Group, Paragon Solutions, SIO, and a constellation of smaller firms sell or rent the capability to extract data from a target's device without the target's knowledge. The business model is straightforward: a government client pays a licence fee — often seven or eight figures — and in return receives a platform that can read messages, harvest location history, and silently activate cameras and microphones. The transaction is legal in the jurisdiction where the vendor is incorporated. What happens on the other end is the client's problem.

In February 2026, researchers documented a new capability in Predator that sharpens the stakes considerably. As Bleeping Computer reported, Intellexa's engineers had figured out how to hook into iOS's SpringBoard — the process that manages the iPhone's home screen and status bar — to suppress the green and orange privacy indicator dots that Apple added in 2020 precisely so users could see when their camera or microphone was active. The malware does not exploit a specific iOS vulnerability. It operates through system-level manipulation once it has already obtained sufficient privileges, meaning the user sees nothing while their camera streams and their microphone records. The indicator dot, long treated as a hard security boundary, turns out to be a UI element that can be silenced.

The finding matters because it collapses a trust architecture that hundreds of millions of iPhone users rely on. Apple designed those dots as a non-bypassable signal — a physical-world guarantee that if the light is off, the sensor is off. Intellexa's update turns that guarantee into an aesthetic preference. The user who picks up their phone, checks for the dot, sees nothing, and assumes they are alone is wrong. They are, in Candido's position, being watched. The vendor shipped this feature as a product improvement.

The regulatory environment that was supposed to constrain this industry is, in early 2026, visibly unravelling. In February, five Democratic senators — led by Ron Wyden of Oregon — sent a letter to the Trump administration demanding an explanation for its decision to lift sanctions on individuals the US government had previously accused of facilitating the spread of commercial spyware. Dark Reading obtained and reported on the letter, which described the sanctions rollback as having created 'confusion about the administration's spyware policy and where it draws the line.' The confusion is not accidental. It is the point.

The sanctions in question were imposed under the Biden administration's 2023 executive order, which prohibited US agencies from doing business with commercial spyware vendors deemed a threat to national security or human rights. Several Intellexa-linked individuals and entities were designated. NSO Group had been sanctioned earlier. The architecture was imperfect — the order covered only US government procurement, not the broader market — but it had a signalling effect. European regulators followed suit. The EU placed Intellexa and its executives on its own sanctions list. Banks grew reluctant to process payments. The industry, for a moment, felt pressure.

The Trump administration's reversal, which came without public explanation, dismantles that signalling architecture. Lifting sanctions on individuals does not simply restore their access to the US financial system; it tells every other jurisdiction watching — including European Union member states weighing their own designations — that Washington is no longer treating commercial spyware as an urgent threat. The effect radiated within weeks. In Spain, the High Court dropped its criminal investigation into the targeting of Prime Minister Pedro Sánchez and other senior politicians with Pegasus spyware, citing an inability to obtain cooperation from Israeli authorities. In Greece, a long-awaited verdict in the 2022 wiretapping scandal that ensnared politicians, journalists, and military officials arrived in February 2026 — and disappointed civil-liberties groups by delivering sentences far lighter than prosecutors had sought.

These events are connected not by conspiracy but by market logic. The spyware industry reads regulatory signals faster than regulators write them. When sanctions lift, payment corridors reopen. When investigations stall, the message to vendors is that the worst-case scenario — a court compelling testimony about how a particular government used a particular tool — is avoidable. The industry adjusts its pricing and its client lists accordingly.

The adjustment is visible not only at the top of the market, where NSO and Intellexa operate, but across a widening middle tier of firms that have learned to route around sanctions by disaggregating the supply chain. A Dark Reading investigation published in March 2026 documented the proliferation of intermediaries — resellers, exploit brokers, contractors, and shell companies — that now stand between the vendor and the end user. A government that cannot buy directly from an Intellexa subsidiary on a sanctions list can purchase through a Cyprus-registered reseller that acquired the same capability from a different legal entity. The tool is identical. The data flows to the same command-and-control servers. The transaction chain simply adds an extra layer of corporate indirection.

This intermediary layer is the part of the data flow that nobody is regulating. The exploit broker who sells a zero-day vulnerability to a vendor operates in one jurisdiction. The vendor, which integrates the exploit into a surveillance platform, operates in another. The reseller, which signs the contract with a government agency, operates in a third. The government agency operates in a fourth. The target, whose body produces the data — whose heartbeat, location, and private conversations are the commodity — resides in a fifth. Each step is, in isolation, treated as a distinct legal event. Taken together, they form a system that is entirely legible to the companies that profit from it and nearly illegible to the regulators tasked with constraining it.

In April 2026, WhatsApp disclosed that it had notified approximately 200 users — primarily in Italy — that they had been tricked into installing a counterfeit version of the messaging app that contained surveillance software built by SIO, an Italian spyware firm. The fake app was delivered outside Apple's App Store, requiring targets to be socially engineered into installing an enterprise certificate profile — a technique that bypasses the platform's code-signing protections. WhatsApp said it planned to pursue legal action against SIO. The case is notable because SIO is not a name that appears in the headlines alongside NSO or Intellexa. It is a smaller, regional player, selling into a European market where the demand for surveillance tools is growing quietly, fed by law-enforcement agencies seeking capabilities they claim are proportionate for investigating serious crime.

The SIO case also illustrates how the consent architecture of commercial spyware has degraded. The 200 Italian users did not consent to surveillance. The enterprises whose certificates were misused did not consent to becoming infrastructure for an intelligence operation. The platform operator, Apple, did not consent to having its enterprise distribution programme weaponised. And yet every entity in the chain — the certificate issuer, the developer who built the counterfeit app, the vendor who licensed the spyware module, the agency that deployed it — can point to a document, a contract, or a terms-of-service agreement that purports to make the operation legitimate. No single actor ever says no, because no single actor feels authorised to say no.

The cost of this architecture is measured in bodies. Candido, the Angolan journalist, was targeted because he was reporting on corruption. The pattern repeats. In 2025, researchers at the Citizen Lab documented Predator infections on phones belonging to civil-society figures in Armenia and Indonesia. Amnesty International's Security Lab has identified targets across the Middle East and sub-Saharan Africa. In February 2026, a spear-phishing campaign uncovered by the Lebanese digital-rights group SMEX targeted a high-profile Lebanese journalist using infrastructure linked to a known surveillance vendor. In each case, the target was doing work that someone powerful wanted to monitor — not because they were a criminal suspect, but because they were a journalist asking questions, a lawyer representing an opposition client, or an activist organising a protest.

The industry's defenders argue that these are cases of misuse — that the tools are designed for legitimate law-enforcement purposes and that the vendor cannot control what the client does with them. The argument collapses under the weight of the evidence. Vendors select their clients. They negotiate the price. They train the operators. They provide ongoing technical support. In a deposition unsealed in WhatsApp's ongoing litigation against NSO Group, a former NSO employee described a system in which the company maintained extensive visibility into how its clients used Pegasus, including the ability to monitor which targets were being infected. The architecture is not hands-off. It is hands-on, with selective blindness.

Apple, for its part, continues to issue emergency security updates — most recently in March 2026, when it patched vulnerabilities exploited by a tool known as DarkSword, and in December 2025, when it raced to close a zero-click vector being used in a wave of targeted infections. The updates are necessary but insufficient. They protect the user who updates immediately; they do not protect the user who does not know they are a target, who does not understand the threat model, or whose device is no longer receiving patches. And they do nothing to address the structural fact that a company in Athens or Tel Aviv or Milan can, with a valid contract, lawfully sell the capability to break into a device that Apple spent billions of dollars securing.

The European Union, which has positioned itself as the world's most aggressive regulator of digital rights, is watching this deterioration with growing alarm but limited tools. The EU's sanctions on Intellexa executives remain in place, and the European Data Protection Supervisor has opened consultations on how the GDPR might apply to spyware-derived data. But the core problem — that a surveillance vendor incorporated in an EU member state can legally sell intrusion technology to a foreign government — is a gap that no single regulation addresses. The proposed EU Cyber Resilience Act contains provisions on software security, but it was not designed to regulate intelligence tradecraft sold as a commercial service. Civil-liberties groups including EDRi and Access Now have urged the European Commission to propose a dedicated export-control regime for commercial spyware, similar to the Wassenaar Arrangement's controls on intrusion software. As of May 2026, no such proposal has been tabled.

The story the industry tells itself is that it is a necessary part of the national-security ecosystem — a private-sector enabler for governments that lack the in-house capability to conduct signals intelligence. The story the data tells is that the targets are, with relentless regularity, journalists, lawyers, dissidents, and human-rights defenders. The gap between the two stories is where the harm lives. It is a gap that sanctions, executive orders, platform lawsuits, and emergency patches have each tried to close from one angle. None have succeeded, because none have addressed the architecture itself. A market in which a surveillance vendor can make more money selling to an authoritarian client than it loses from a US sanctions designation is a market that sanctions alone cannot fix.

On May 9, 2026, the question is not whether commercial spyware exists — it does, and it will continue to exist — but whether the regulatory response is converging on a regime that can meaningfully disrupt the transactions that matter: the contract signed in a back office in Nicosia, the wire transfer routed through a bank that does not ask questions, the exploit delivered to a phone belonging to a woman who has never heard of NSO Group or Intellexa and should never have needed to. The Senate Democrats' letter remains unanswered. The EU consultation remains open. The next infection is already being provisioned.