Surveillance research: Add infobox logo (Cytrox logo.png)

2026-11-10T15:37:57Z

Add infobox logo (Cytrox logo.png)

Surveillance research: Expand surveillance research with sourced history, people and financial tables; preserve existing coverage

2026-11-08T08:17:38Z

Expand surveillance research with sourced history, people and financial tables; preserve existing coverage

New page

{{short description|'''Spyware developer within the Intellexa consortium'''}}
{{Infobox organization
| name = [[Cytrox]]
| type = Commercial spyware developer; multiple legal entities
| founded = {{Start date|2017}} <ref name="PB8CytroxDiscovery">Citizen Lab, [https://citizenlab.ca/research/pegasus-vs-predator-dissidents-doubly-infected-iphone-reveals-cytrox-mercenary-spyware/ Pegasus vs. Predator: Dissident’s Doubly-Infected iPhone Reveals Cytrox Mercenary Spyware], ''Citizen Lab'', 16 December 2021, key findings and sections 1.1–1.2, 2 and 4, accessed 8 November 2026.</ref>
| headquarters = North Macedonia; associated entities in Hungary and Israel <ref name="PB8CytroxDiscovery" />
| area_served = Government customers internationally
| services = [[Predator]] spyware <ref name="PB8CytroxDiscovery" />
| key_people = [[Ivo Malinkovski]] (chief executive identified by [[Citizen Lab]] in 2021); [[Tal Dilian]] (linked acquirer through [[WiSpear]]) <ref name="PB8CytroxDiscovery" />
| remarks = Part of the [[Intellexa]] consortium; [[Cytrox AD]] and [[Cytrox Holdings ZRT]] designated by the [[US Department of the Treasury]] on 5 March 2024 <ref name="PB8TreasuryIntellexa">US Department of the Treasury, [https://home.treasury.gov/news/press-releases/jy2155 Treasury Sanctions Members of the Intellexa Commercial Spyware Consortium], ''US Department of the Treasury'', 5 March 2024, “Key Enablers” and “Sanctions Implications”, accessed 8 November 2026.</ref>
}}
'''[[Cytrox]]''' is a developer of [[Predator]] spyware associated with the [[Intellexa]] consortium. [[Citizen Lab]] reported that it began as a North Macedonian start-up in 2017 and had linked corporate entities in Israel and Hungary. The group includes distinct companies, including [[Cytrox AD]] in North Macedonia and [[Cytrox Holdings ZRT]] in Hungary.<ref name="PB8CytroxDiscovery" /><ref name="PB8TreasuryIntellexa" />

==Corporate history and Israeli connections==
[[Citizen Lab]]'s December 2021 investigation found that [[Cytrox]] EMEA Ltd. and Cytrox Software Ltd. had been incorporated in Israel in 2017 and renamed Balinese Ltd. and Peterbald Ltd. respectively in 2019. It reported that [[WiSpear]], associated with former Israeli [[Unit 81]] commander [[Tal Dilian]], acquired Cytrox in 2018. Citizen Lab described the precise relationships within the wider [[Intellexa]] alliance as incompletely resolved by the registry records it examined.<ref name="PB8CytroxDiscovery" />

Cytrox originated in North Macedonia; its later Israeli corporate and ownership connections are distinct from its place of origin. [[Unit 81]] and [[Unit 8200]] are separate units; Dilian's service in the former does not establish service in the latter.<ref name="PB8CytroxDiscovery" />

{| class="wikitable sortable"
|+ People and entities in the dated public record
! Person or entity !! Role or jurisdiction !! Date and qualification
|-
| [[Ivo Malinkovski]] || Chief executive identified by [[Citizen Lab]] || 2021; a historical identification, not confirmation of the present officeholder <ref name="PB8CytroxDiscovery" />
|-
| [[Tal Dilian]]; [[WiSpear]] || Reported acquirer || Acquisition reported as occurring in 2018 <ref name="PB8CytroxDiscovery" />
|-
| [[Cytrox AD]] || North Macedonia || Treasury described it as developer of [[Predator]] in March 2024 <ref name="PB8TreasuryIntellexa" />
|-
| [[Cytrox Holdings ZRT]] || Hungary || Treasury described earlier Predator development before production moved to North Macedonia <ref name="PB8TreasuryIntellexa" />
|}

==Predator and forensic findings==
In December 2021 [[Citizen Lab]] reported that Egyptian opposition politician [[Ayman Nour]] and an anonymous exiled Egyptian journalist had been hacked with [[Predator]] in June 2021. It recovered and analysed a loader and described single-click links delivered through [[WhatsApp]], affecting the then-current iOS 14.6. Nour's phone was also infected with [[NSO Group]]'s [[Pegasus]] by a different government client, illustrating that more than one operator could target the same device.<ref name="PB8CytroxDiscovery" />

The researchers' network scans identified likely Predator customers in several countries, but this inference was separate from forensic confirmation of the two examined phones. The report did not establish that every server or jurisdiction identified represented a successfully infected victim.<ref name="PB8CytroxDiscovery" />

==US designations==
The [[US Department of the Treasury]] designated [[Cytrox AD]] and [[Cytrox Holdings ZRT]] on 5 March 2024 alongside [[Tal Dilian]], [[Sara Hamou]] and other [[Intellexa]] entities. The notice also records that the two [[Cytrox]] entities had been added to the [[US Department of Commerce]] Entity List on 18 July 2023. Treasury attributed the sanctions to development, operation and distribution of spyware used to target Americans; these are administrative designations, not criminal convictions.<ref name="PB8TreasuryIntellexa" />

==Meta platform investigation==
In December 2021 [[Meta]] said that it had removed about 300 [[Facebook]] and [[Instagram]] accounts linked to [[Cytrox]]. It reported domains imitating news organisations and URL-shortening services, and technical checks that limited infection to selected IP addresses and device types. The report attributed the activity to Cytrox and its customers and identified politicians and journalists among the targets.<ref name="PB8Meta2021">Mike Dvilyanski, David Agranovich and Nathaniel Gleicher, [https://about.fb.com/wp-content/uploads/2021/12/Threat-Report-on-the-Surveillance-for-Hire-Industry.pdf Threat Report on the Surveillance-for-Hire Industry], Meta, 16 December 2021, p. 10, accessed 8 November 2026.</ref>

==See also==
* [[Intellexa]]
* [[Tal Dilian]]
* [[Predator]]
* [[NSO Group]]
* [[Candiru]]

==Notes==
<references/>

[[Category:Surveillance]]
[[Category:Israel]]

@@ Line 1: / Line 1: @@
 {{short description|'''Spyware developer within the Intellexa consortium'''}}
 {{Infobox organization
 | name = [[Cytrox]]
 | type = Commercial spyware developer; multiple legal entities

Cytrox - Revision history

Surveillance research: Add infobox logo (Cytrox logo.png)

Surveillance research: Expand surveillance research with sourced history, people and financial tables; preserve existing coverage