Citizen Lab Finds Cellebrite Used on Kenyan Activist’s Phone in Police Custody
Summary
Citizen Lab found high-confidence indicators Kenyan authorities used Cellebrite on activist Boniface Mwangi’s phone in custody. Amnesty separately confirmed Predator infected Angolan journalist Teixeira Cândido’s iPhone via a WhatsApp link.
Key points
- Citizen Lab found high-confidence indicators Cellebrite tools were used on Boniface Mwangi’s Samsung phone while it was in Kenyan police custody in July 2025.
- The phone was returned without password protection nearly two months later; Citizen Lab said Cellebrite use could have enabled extraction of sensitive data, but the article does not establish what was extracted.
- Citizen Lab also reported likely Cellebrite use by Jordanian authorities against activists and human rights defenders between late 2023 and mid-2025.
- Amnesty International confirmed Predator spyware infected Angolan journalist Teixeira Cândido’s iPhone in May 2024 after he opened a link received via WhatsApp; the exploit used is unknown.
- The Predator infection appears to have lasted less than a day. Eleven later infection attempts through June 16, 2024, appear to have failed.
- The article reports Predator anti-analysis and anti-forensics features, including crash reporting and SpringBoard hooking to suppress recording indicators.
Article Details
- Event Type
- Reports of commercial surveillance technology use against civil society: Citizen Lab assessed with high confidence that Cellebrite forensic extraction tools were used on Boniface Mwangi’s phone in Kenyan police custody, and Amnesty confirmed Predator spyware infected Teixeira Cândido’s iPhone.
- Impact
- Mwangi’s phone was returned unlocked; Citizen Lab said Cellebrite use could have enabled extraction of messages, files, passwords, financial information, and other sensitive data, but did not confirm what was extracted. Predator infection of Cândido’s phone was forensically confirmed and could have given the attacker unrestricted access. The infection appears to have ended when the phone was restarted, and 11 later reinfection attempts appear to have failed.
MITRE ATT&CK
People
Boniface MwangiKenyan pro-democracy activist whose phone was assessed with high confidence to have been accessed using Cellebrite tools while in police custody.Nir AvrahamJamf Threat Labs researcher who discussed Predator’s error-code system and operators’ visibility into failed deployments.Shen YuanJamf Threat Labs researcher who discussed Predator’s error-code system and operators’ visibility into failed deployments.Teixeira CândidoAngolan journalist and press freedom advocate whose iPhone Amnesty confirmed was infected with Predator spyware.
Malware
Vendors
CellebriteCitizen Lab found high-confidence indicators that Kenyan authorities used Cellebrite forensic extraction tools on pro-democracy activist Boniface Mwangi’s Samsung phone while it was in police custody in July 2025.IntellexaSeparate investigations also confirmed Intellexa’s Predator spyware infected Angolan journalist Teixeira Cândido’s iPhone in May 2024, highlighting a broader pattern of commercial surveillance tools being abusedSamsungCitizen Lab found high-confidence indicators that Kenyan authorities used Cellebrite forensic extraction tools on pro-democracy activist Boniface Mwangi’s Samsung phone while it was in police custody in July 2025.
Products
iOS 16.2The iPhone was running iOS 16.2, an outdated version of the operating system with known security issues.iPhonealso confirmed Intellexa’s Predator spyware infected Angolan journalist Teixeira Cândido’s iPhone in May 2024, highlighting a broader pattern of commercial surveillance tools being abused against civilPredatorSeparate investigations also confirmed Intellexa’s Predator spyware infected Angolan journalist Teixeira Cândido’s iPhone in May 2024, highlighting a broader pattern of commercial surveillance tools being abusedSamsung phoneCitizen Lab found high-confidence indicators that Kenyan authorities used Cellebrite forensic extraction tools on pro-democracy activist Boniface Mwangi’s Samsung phone while it was in police custody in July 2025.WhatsAppAmnesty confirmed Intellexa’s Predator spyware infected Angolan journalist Teixeira Cândido’s iPhone via a WhatsApp infection link in May 2024.
Countries
AngolaIn multiple reports published last year, Recorded Future revealed that it has observed suspected Predator operations in Angola dating back to 2024.Jordanlatest findings follow a separate report released last month, in which the researchers said officials in Jordan likely used Cellebrite to extract information from the mobile phones of activists and human rights