Intellexa
Commercial spyware consortium founded by Tal Dilian; vendor of the Predator implant
| Intellexa
| |
|---|---|
| Logo |  Intellexa logo ("The Intelligence Alliance") |
| Type | Spyware consortium |
| Founder(s) | Tal Dilian |
| Headquarters | Greece; corporate shells also in Ireland and North Macedonia |
| Industry | Spyware |
| Services | Predator spyware |
Intellexa is a commercial spyware consortium founded by Tal Dilian, a former Israeli military intelligence officer. Its product, Predator, was developed by Cytrox, a company inside the consortium. The corporate shells have sat in Greece, Ireland and North Macedonia. In July 2023 the US Commerce Department added Intellexa and Cytrox entities to the Entity List. In 2024 the US Treasury sanctioned the consortium for spyware used against Americans. In February 2026 an Athens court found Dilian and three others guilty of breaching personal data in the Greek wiretapping scandal, and sentenced each to 126 years and eight months, capped at eight years to be served, pending appeal.[1][2][3][4]
The product
Predator is the implant. Cytrox built it. A phone is infected, and the take is messages, mail and the microphone, as with NSO Group's Pegasus and Paragon Solutions' Graphite. The difference is the corporate form. Intellexa has been a consortium rather than a single Tel Aviv company, with shells used to sell across borders. Dilian told Greek television in March 2026 that the firm sells only to authorised governments and law-enforcement agencies, does not run the surveillance itself, and that lawful use “rests with the sovereign authorities that acquire and operate them.” That is the NSO line.[5]
On 4 December 2025 Amnesty International’s Security Lab, with Inside Story, Haaretz and WAV (“Intellexa Leaks”), published leaked internal material including a mid-2023 training video. The video showed Intellexa staff connecting remotely, via TeamViewer, to at least ten live customer Predator deployments, including operational dashboards and logs of infection attempts. Amnesty said the access reached systems that hold targeting information and collected surveillance data. A lawyer for Dilian told Haaretz that Dilian had “not committed any crime nor operated any cyber system in Greece or anywhere else.” The finding is of vendor access to live customer systems. It is not a finding that the Israeli state receives the take.[6][7]
Greece
The scandal broke in 2022, after a financial journalist, Thanasis Koukakis, and the leader of PASOK said they had been under state surveillance by phone malware. Court documents said Koukakis’s phone was infected with Predator. Traces were later found on dozens of phones, including politicians, ministers, intelligence officers and businessmen. OCCRP put the verified victims at 87, across civil society, politics, the military and business. The head of the Greek intelligence service, EYP, and the prime minister’s chief of staff were sacked. In 2024 the Supreme Court prosecutor shelved a case against EYP and sent four defendants to be tried on misdemeanour charges.[1][2]
On 26 February 2026 the Misdemeanour Court in Athens convicted Dilian, the shareholder Felix Bitzios, the business manager Sara Aleksandra Hamou, and Giannis Lavranos, owner of the supplier Krikel. Each received 126 years and eight months. Time to be served is capped at eight. None entered a formal plea. All denied the charges, and were represented by lawyers. The court sent the case back for investigation of more serious offences, including espionage, violation of state secrets, trafficking in spyware, and the role of third parties, including people on the EYP payroll. The ruling sits against the 2024 decision that cleared the service.[1][2]
Dilian’s statement after the verdict, that the only customers are governments, was read by the opposition as an admission that the state had run the campaign. He used it as the opposite: the company sold a tool, and the buyer operated it. The court found the software was used on the 87. It did not, in the misdemeanour judgment, name the operator.[5]
US designations
On 18 July 2023 the Commerce Department’s Bureau of Industry and Security added Intellexa S.A. (Greece), Intellexa Limited (Ireland), Cytrox Holdings Zrt. (Hungary) and Cytrox AD (North Macedonia) to the Entity List, for trafficking in cyber exploits used to gain access to information systems. The listing, published in the Federal Register on 19 July 2023, imposes a licence requirement for all items subject to the EAR, with a presumption of denial. It is the same class of Commerce instrument used against NSO Group and Candiru in November 2021.[3][4]
In 2024 the US Treasury's Office of Foreign Assets Control sanctioned the consortium for developing, operating and distributing commercial spyware used to target Americans, including US government officials, journalists and policy experts. That is a different instrument from the Entity List. The effect is the same class of finding: the export was treated in Washington as a security problem. It is not a finding that the Israeli ministry reads the product. Dilian’s own line is that the buyer operates it, under export rules.[2]
Chaia Services
On 2 March 2024 Haaretz published an investigation by Gur Megiddo of TheMarker into an anonymous complaint alleging that Eric Banoun and Maria Pulera had sold spyware without export permits through Chaia Services Ltd, a British Virgin Islands company. The paper said the complaint's alleged connection to Intellexa rested on one detail, "whose veracity is also in doubt": the ostensible signature of Dilian's ex-wife, Sara Hamou, as a Chaia director on a reseller agreement attached to the complaint. According to that reseller agreement reported by Haaretz, whose signature her lawyer says is forged, Hamou was a Chaia director. Banoun and Pulera also said the signature was a forgery, and Hamou's lawyer told TheMarker that she never signed the agreement. Haaretz added that even an authentic signature would not prove Dilian's involvement, as Hamou had acted as a director on behalf of clients. Intellexa told TheMarker: "This company does not now have, and has never had, commercial ties with Chaia Services Ltd." Banoun called the allegations "unfounded and baseless".[8]
In October 2026 Citizen Lab reported that Chaia Services Ltd had been a shareholder of the Israeli advertising firm Discover-Tech between 2020 and March 2026, and linked it to Hamou on the strength of the Haaretz report.[9]
See also
- NSO Group
- Paragon Solutions
- Candiru
- Tal Dilian
- Sara Hamou
- Discover-Tech
- Unit 8200
- Black Cube
- Cyber and tech firms founded by ex Unit 8200 or occupation forces veterans
- Senpai Technologies
Notes
- ↑ 1.0 1.1 1.2 Greek court finds four guilty of prying on private data, Reuters, 26 February 2026.
- ↑ 2.0 2.1 2.2 2.3 Greek Court Hands Down Maximum Sentences in Predator Spyware Case, OCCRP, 26 February 2026.
- ↑ 3.0 3.1 Commerce Adds Four Entities to Entity List for Trafficking in Cyber Exploits, US Bureau of Industry and Security, 18 July 2023.
- ↑ 4.0 4.1 Additions to the Entity List, Federal Register, 19 July 2023 (effective 18 July 2023).
- ↑ 5.0 5.1 Convicted Spyware Dealer Links Greek Government to Surveillance Scandal, OCCRP, 13 March 2026.
- ↑ To Catch a Predator: Leak exposes the internal operations of Intellexa’s mercenary spyware, Amnesty International Security Lab, 4 December 2025.
- ↑ Lorenzo Franceschi-Bicchierai, Sanctioned spyware maker Intellexa had direct access to government espionage victims, researchers say, TechCrunch, 4 December 2025.
- ↑ Gur Megiddo, 'Send $3 Million or I'll Expose You': A Businessman, a Filmmaker and an Alleged Israeli Spyware Deal Gone Awry, Haaretz (English edition of a TheMarker investigation), 2 March 2024 (archived copy), accessed 22 October 2026.
- ↑ Bill Marczak et al., How Discover-Tech Turned Targeted Ads Into a Pipeline for Zero-Click Mercenary Spyware, Citizen Lab, 15 October 2026, accessed 22 October 2026.