WhatsApp has revealed that spyware developed by the Israeli cybersecurity firm Paragon was used to hack nearly 100 journalists and civil society activists, marking the first time the company has been publicly linked to potential misuse of its surveillance technology.
In a statement on Friday, the Meta-owned messaging platform disclosed that it had identified and disrupted an attempt to compromise around 90 users of its service. While WhatsApp did not specify the geographical locations of the targets, a company official confirmed that they included members of the media and civil society organizations. The official declined to elaborate on how WhatsApp traced the attack to Paragon but stated that law enforcement and industry partners had been notified.
Paragon, which specializes in offensive cybersecurity tools, works exclusively with state entities, including the Israeli security establishment and the U.S. Federal Bureau of Investigation (FBI). The company’s flagship spyware, Graphite, provides hacking capabilities to its clients, enabling them to infiltrate mobile devices. The FBI has not yet commented on WhatsApp’s findings.
The revelation comes at a pivotal moment for the spyware industry. The U.S. government has spent the last four years cracking down on companies engaged in offensive cyber operations, particularly Israeli firms. However, with former President Donald Trump likely to return to the White House, industry analysts expect a policy shift that could ease restrictions on these firms. One such firm, NSO Group, the maker of the controversial Pegasus spyware, was blacklisted by the Biden administration, preventing American companies from doing business with it. If Trump reverses that decision, it could reshape the global spyware market.
Paragon has been in the spotlight since its recent acquisition by RED Lattice, a U.S. cybersecurity company owned by AE Industrial Partners, an investment fund specializing in defense and homeland security. The $500 million deal, finalized in December, was seen as a milestone in U.S.-Israel relations concerning commercial spyware. Unlike previous attempts by American defense firms to acquire Israeli cyber companies—such as L3Harris’ failed bid for NSO Group—the Paragon sale proceeded with Israeli government approval.
Founded by former Israeli Prime Minister Ehud Barak and ex-military intelligence commander Ehud Schneorson, Paragon operates under the supervision of Israel’s Defense Ministry. The company has marketed its Graphite spyware to law enforcement agencies in Israel, Europe, and the United States. Despite claims that these tools are essential for combating crime and terrorism, spyware from companies like Paragon and NSO Group has repeatedly been found on the phones of journalists, activists, opposition politicians, and even U.S. government officials.
John Scott-Railton, a researcher at Citizen Lab, a Canadian internet watchdog group that investigates spyware abuse, called the WhatsApp discovery a stark reminder of the unchecked proliferation of mercenary spyware. “As these tools spread, we continue to see the same disturbing patterns of misuse,” he warned.
Meta has been actively fighting spyware companies in court. In December, a U.S. court ruled in favor of WhatsApp in its lawsuit against NSO Group, holding the Israeli company accountable for hacking 1,400 devices through a vulnerability in the app. NSO had unsuccessfully argued that it was entitled to sovereign immunity due to its state-approved sales to government agencies. The case reaffirmed that private spyware firms, rather than the Israeli government, could be held liable for misuse of their technology.
