An Israeli firm coached Indonesia on finding gay men on Facebook and tracked a Mozambican opposition leader days after his arrest. Haaretz has its files.

An Israeli company coached Indonesian government staff on how to find gay men on Facebook. A CyberGlobes analyst told them to search the local slang for gay, find outspoken activists, open their profiles, and pull the groups they belong to. Indonesia canes men for being gay.

That is one file in a leak of CyberGlobes' internal videos, presentations, and activity logs obtained by Haaretz and TheMarker. The company, based in Be'er Sheva and founded in 2016 by two veterans of Israel's Prime Minister's Office, sells a product called Atlas. It does not hack phones. It harvests social media, including posts inside closed Facebook groups, and pairs that with a database of passwords and credit card numbers stolen in dark web breaches. Draw a box on a map, pick a time window, and Atlas lists everyone who posted from inside it. That is a protest roster.

The logs show company staff running the searches themselves. In November 2024, days after Mozambican opposition leader Vitano Singano was jailed on coup charges, a CyberGlobes employee ran his name through breach databases and a facial recognition scan and saved the results to a folder labeled Mozambique Investigations. Singano was released, then abducted off a Maputo street in July 2025. Nobody has seen him since. The same week, the employee ran the same searches on the opposition presidential candidate, who had fled the country.

In Rwanda, the company built a ranked list of every user who liked or shared posts by an anonymous critic of Paul Kagame. In Kuwait, it hunted a London-based dissident's passwords; Kuwait stripped his citizenship months later. In Nigeria, an analyst filtered participants in a cost-of-living protest while the government was trying dozens of them for treason. A pitch to Bangladesh offered to track Rohingya refugees.

CyberGlobes used to travel with NSO Group and sell as a package. One source told Haaretz why: "Before you hack someone's phone, you need to know whose phone to hack." Because it calls itself an open-source intelligence firm, it sits outside Israel's defense export regime. Facebook removed more than 200 fake accounts tied to it in 2022. Clients and trial customers include Saudi Arabia, the UAE, Morocco, Angola, and also the United States, Norway, and the Netherlands, where it trained police to identify people protesting COVID restrictions.

The company says the leak came from a hack by a hostile party, that some documents were edited, and that it operates lawfully. It would not say which documents.

CyberGlobes is now in the tracker as a Tier 2 vendor with a Danger Score of 8. Full record: https://surveillance.fineprint.report