WhatsApp has revealed that approximately 90 users, including journalists and civil society members across more than two dozen countries, were targeted by sophisticated spyware developed by Israeli company Paragon Solutions.
On Friday, the Meta-owned messaging platform announced that it had detected and disrupted the spyware campaign, expressing "high confidence" that the users were targeted and "possibly compromised."
The attack utilized a "zero-click" exploitation method, meaning targets could be infected without any user interaction through malicious PDF files distributed in WhatsApp group chats.
This stealthy approach allowed attackers to access victims' devices, including the ability to read encrypted messages sent through apps like WhatsApp and Signal.
Paragon's spyware, known as Graphite, has capabilities comparable to the notorious Pegasus spyware. While Paragon markets itself as an ethical surveillance tool provider serving democratic governments for national security and crime-fighting purposes, WhatsApp's discovery has raised serious concerns about the commercial spyware industry's impact on privacy and civil liberties.
WhatsApp has sent Paragon a cease-and-desist letter in response to the attack and is exploring legal options. The company is also working with Canadian internet watchdog Citizen Lab to investigate the incidents and has notified law enforcement and industry partners about the breach.
Citizen Lab researcher John Scott-Railton said the discovery of Paragon spyware targeting WhatsApp users "is a reminder that mercenary spyware continues to proliferate and as it does, so we continue to see familiar patterns of problematic use."
NEW: @WhatsApp says Israeli mercenary spyware company #Paragon targeted scores of users around world.
— John Scott-Railton (@jsrailton) February 1, 2025
The infection happened with no interaction. No link to click or attachment to open.
This is called a "zero-click" attack.
WA says targets included journalists & members of… pic.twitter.com/TekGNMdkoF
This revelation comes shortly after WhatsApp's recent legal victory against NSO Group, another Israeli spyware maker, in a California court. The judge ruled that NSO was liable for attacks that compromised 1,400 WhatsApp users in 2019.
Natalia Krapiva, senior tech-legal counsel at advocacy group Access Now, noted that while Paragon had cultivated a reputation as a more responsible spyware company, these revelations suggest otherwise. "This is not just a question of some bad apples — these types of abuses are a feature of the commercial spyware industry," she stated.
Paragon, co-founded by former Israeli Prime Minister Ehud Barak, was reportedly acquired by US private equity firm AE Industrial Partners for $900 million. However, the deal awaits regulatory approval in Israel. Reuters said that AE did not immediately return a message seeking comment.