Walter Delgatti Neto rose to fame (and later fell from grace) after breaking into the Telegram accounts of prosecutors of Brazil’s world-famous anti-corruption probe, Operation Car Wash, in 2019. The information he obtained — and leaked to The Intercept Brasil — exposed a series of irregularities in the investigation, and destroyed the legacy of former judge Sergio Moro.
Three years later, Mr. Delgatti tried to add to his list of famous victims by attempting to hack Alexandre de Moraes, a high-profile justice of Brazil’s Supreme Court and the country’s top electoral judge at the time of last October’s elections.
Information obtained by The Brazilian Report from anonymous sources, as well as interviews with Mr. Delgatti himself, show that the hacker sought the means to clone Justice Moraes’s SIM card in order to gain access to the judge’s personal information and dig up dirt that could discredit him.
In itself, this revelation is extremely serious. But it takes on even more severe contours when placed alongside other elements.
After radical supporters of far-right former President Jair Bolsonaro stormed and ransacked the headquarters of Brazil’s Congress, Supreme Court, and presidential palace on January 8, federal police searched the home of former Justice Minister Anderson Torres and found a draft decree that would put the electoral courts under a “state of defense” and allow Mr. Bolsonaro to stage a coup d’état.
Last week, a pro-Bolsonaro senator told Veja magazine that the former president had tried to recruit him to wiretap Justice Alexandre de Moraes. The idea, which the judge himself described as a fool’s errand, was to secretly record the head of the electoral court in the hope that he would say something to raise suspicion about last October’s electoral results.
Taken together, the two events provide evidence of a coup plot at the heart of the Bolsonaro government. The Brazilian Report‘s revelations add new elements to this conspiracy.
On top of that, the hacker who admitted to plotting to break into Justice Moraes’s cell phone affirmed that he works for loyalist pro-Bolsonaro Congresswoman Carla Zambelli. He claims to have an under-the-table contract with Ms. Zambelli, providing social media management services for BRL 6,000 (USD 1,157) a month.
"I'm a hacker and a con man"
In November 2022, while supporters of the defeated far-right President Bolsonaro were blocking federal highways and demanding a military coup to annul the election result from the previous month, The Brazilian Report received a strange direct message on Twitter.
“I’m a hacker and a con man,” it began. “While doing my ‘jobs,’ I met a guy who I ended up working with, we became friends, and he revealed his identity to me.”
The “guy” in question turned out to be Walter Delgatti Neto, infamous for his role in the Operation Car Wash leaks. His revelations in 2019 showed that former judge Sergio Moro was in cahoots with the anti-corruption probe’s prosecution team, and the leaks were part of the reason for the Supreme Court to declare Mr. Moro biased in his rulings against now-President Luiz Inácio Lula da Silva.
Lula’s corruption convictions were eventually quashed, allowing him to run for (and win) the presidency in 2022.
Our source, who spoke on condition of anonymity, said they had evidence that Mr. Delgatti was working for Mr. Bolsonaro and far-right Congresswoman Carla Zambelli. “And recently, he asked for my help to try to break into the cell phone of the head of the Superior Electoral Court, Alexandre de Moraes.”
The plan, the source confirmed, was to hack Justice Moraes’s phone in search of “dirt” that could discredit him. The head of Brazil’s electoral court is seen as Mr. Bolsonaro’s nemesis and has been the target of some of the former president’s most vitriolic attacks.
The hackers tried to hire a “SIM-swapper,” typically a person who works for a major cell phone carrier and has the tools to create a new SIM card with Justice Moraes’s number.
The SIM swap scam is a type of account takeover fraud that generally targets a weakness in two-factor authentication and two-step verification in which the second factor or step is a text message (SMS) or call placed to a mobile telephone. These scams involve supplanting the original SIM with the clone, allowing hackers to access the victim’s phone records, messages, files, and apps without ever having to physically seize the device.
The source sent The Brazilian Report screenshots of their Telegram conversations with the alleged hacker. “But why do you want Xandão‘s phone?” the source asked. “Xandão” is a commonly used nickname to refer to Justice Alexandre de Moraes. The answer: “To get into his email and see what he’s been up to.”
The source then asked if the hacker planned to “do what he did to [Sergio] Moro,” referring to the Operation Car Wash leaks, in which Mr. Delgatti broke into the Telegram accounts of both Mr. Moro and federal prosecutor Deltan Dallagnol.
The hacker then sent a series of voice messages to the source, promising to pay BRL 10,000 in cash or Bitcoin for the SIM swap operation against Justice Moraes. He says the money would come from “people behind” the operation.
The Telegram profiles of both the source and the hacker (allegedly Mr. Delgatti) are attributed to aliases. While the voice in the audio messages sounded very similar to Mr. Delgatti’s, we were initially unable to confirm their veracity. Shortly thereafter, the source deleted their Telegram account and went silent for almost three months.
The source resurfaced at the end of last week, after weekly magazine Veja published an interview in which Senator Marcos do Val claimed he had been “coerced” by Mr. Bolsonaro to help wiretap Justice Moraes.
On Thursday, February 2, we contacted our source, Mr. Delgatti, and other people close to him to ask about the audio messages we had received late last year. The source sent us a series of new screenshots containing conversations with the hacker they claimed to be Walter Delgatti, using a new Telegram account.
That same evening, Mr. Delgatti contacted The Brazilian Report to arrange a time to speak. The following day, we had six voice and video calls with Mr. Delgatti via WhatsApp. He also spoke with The Brazilian Report via Telegram, using the same account as shown in the screenshots we received from our source — the first confirmation of the hacker’s identity.
During the phone conversations with Mr. Delgatti, we played the Telegram audio messages in an attempt to confirm their authenticity. “That’s my voice,” he said.
“So the story is: Walter Delgatti commissioned the hacking of [Supreme Court Justice] Alexandre de Moraes,” The Brazilian Report said, during the conversation. “Perfect, it’s the truth,” Mr. Delgatti replied.
Swapping sides
After his role in the Car Wash leaks, the Federal Police investigated and arrested Mr. Delgatti as part of Operation Spoofing, in which he was accused of hacking the phones of almost 200 public figures in 2019.
He is currently on parole, but must abide by a series of rules. For instance, he is prohibited from using the internet.
Mr. Delgatti was once seen as a hero of the left due to his role in the events which led to President Lula’s corruption charges being quashed by the Supreme Court. However, feeling abandoned by those who once sang his praises, he switched sides and cozied up to Bolsonarism instead.
While Mr. Bolsonaro was still in office, he held a meeting with Mr. Delgatti at the presidential residence on August 10 of last year. He spent around two hours chatting with the then-head of state. Their meeting was reportedly arranged by Congresswoman Carla Zambelli.
Ms. Zambelli told the press that the meeting with Mr. Delgatti was to find weaknesses in Brazil’s electronic ballot boxes — part of Mr. Bolsonaro’s oft-repeated conspiracy theory that the country’s electoral system is rigged. However, according to Veja magazine, the president asked Mr. Delgatti to take the blame for an illegal wiretapping of Justice Moraes, which had allegedly already been carried out. The circumstances of this wiretapping and whether it actually took place remain unclear.
What we do know is that Mr. Delgatti also intended to hack Justice Moraes’s cell phone at that time. The Brazilian Report asked Mr. Delgatti, in one of our phone interviews, whether there was any connection between his ties with Ms. Zambelli and the hacking attempt — or whether it was all one big coincidence.
He replied that the hack was his idea, despite affirming in messages to our source that he knew “people willing to pay” for access to Justice Moraes’s phone. Furthermore, Mr. Delgatti emphasized the existence of his relationship with Ms. Zambelli.
“I still work for [Carla Zambelli]. I take care of her website, her social media accounts, which are banned in Brazil, everything. But I have a contract,” he said.
Ms. Zambelli’s official accounts on YouTube, Facebook, Instagram, Twitter, Telegram, TikTok, and LinkedIn were banned in Brazil from November 1 until last week, as punishment for inciting crimes against democracy.
“It’s not registered. But I opened a company, [weekly magazine] Veja reported that a couple of months ago, and I provide services for her.”
“She had a contract with a company that provided the same services, the contract ended, and then she signed a contract with me because I was able to do it for less. But she pays with her own money. Actually, she’s late in paying me this month.”
According to Mr. Delgatti, Ms. Zambelli pays him BRL 6,000 a month, and he has been working for her ever since their meeting at the presidential palace in August last year.
“The people on the left who were helping me stopped helping me, so I went to Carla and said ‘hey, help me out, give me a job.’ And she said: ‘O.K., we’ve got a contract with the people who take care of my social media and website, the contract is coming to an end, if you cover the amount I’ll hire you.’ And I provide services for her, it’s all detailed.”
Initially, the hacker agreed to provide the documents proving his link with Carla Zambelli. Hours later, he backtracked — saying he was afraid of losing his job and salary.
Twelve days after meeting with Mr. Bolsonaro and Ms. Zambelli, Mr. Delgatti opened a company through which he claims to provide services to the far-right congresswoman. The contract does not appear on the books of Ms. Zambelli’s parliamentary office, or her 2022 re-election campaign.
Since August, when Mr. Delgatti opened his company, Ms. Zambelli’s office has only once made a payment of exactly BRL 6,000, to the company BM Gestão de Mídias Sociais, on December 8, 2022.
The invoice in question states that the payment relates to the “provision of services of post-production, editing, and polishing of videos about the parliamentary activities of Congresswoman Carla Zambelli, to be published on her social media accounts and website” between the period of December 1 and 31.
Among BM’s former clients is pro-Bolsonaro Congresswoman Bia Kicis, who first hired the company in 2020 to manage her social media accounts, a period during which her social channels spread several instances of misinformation about the Covid pandemic. Ms. Kicis paid the company BRL 6,000 a month until May of last year.
BM Gestão de Mídias Sociais is headquartered in the small city of Cornélio Procópio, in the southern Brazilian state of Paraná. The company is registered in the name of Lindara Liberta da Silva. Speaking to Agência Pública in 2020, Ms. Silva said that the de facto owner of the company is her son-in-law Humberto Bernardino da Silva, better known as Beto Morato, a politician, activist, and member of the right-wing social movement Nas Ruas, founded by Ms. Zambelli in 2011.
The Brazilian Report contacted Lindara Liberta da Silva, who denied being the owner of the company. Her name appears only once more on Ms. Zambelli’s books, with the same company being hired in August to provide similar audiovisual services, this time for BRL 3,000.
Speaking to The Brazilian Report, Ms. Zambelli said that she has never employed Walter Delgatti. After being informed that Mr. Delgatti himself confirmed the existence of a work contract between them, she added: “I don’t have any relationship with Walter with regards to trying to wiretap [Alexandre de] Moraes.”
Mr. Delgatti also agreed to two face-to-face interviews with The Brazilian Report, but failed to show up for either.
On Sunday, February 5, he attempted to change his story by claiming that the Telegram audio messages were from May or June 2019, before he was banned from using the internet. However, Mr. Delgatti was unable to explain why, in one of the recordings, he mentioned the Central Bank’s instant payment system PIX. The service was only launched in November 2020.
The Brazilian Report contacted the press office of Justice Moraes, who refused to comment on the case or answer whether there are any investigations underway about attempts to hack his cell phone.