Loading story…
Paragon Solutions’ safeguards against abuse of its Graphite mobile spyware face scrutiny after CEO Andrew Boyd told WIRED that the company cannot determine whether customers misuse its software and lacks a kill switch to disable customers in cases of misuse. Paragon does not require customer-use logs or have access to them, limiting its ability to audit targeting. Boyd defended that arrangement as necessary to protect customers’ sensitive targeting information and described customer vetting as the primary safeguard. The disclosures follow Citizen Lab’s confirmation in 2025 that Paragon spyware had been used to target Italian activists and journalists.
Paragon had promised not to sell to governments with poor human rights records and to cut off customers who misuse its products. Citizen Lab researcher John Scott-Railton argued that the disclosures undermine those commitments and the spyware industry’s claims that it can self-regulate; US Senator Ron Wyden also criticized the lack of meaningful accountability. The scrutiny follows broader efforts to curb commercial spyware abuse, including 2021 US Commerce Department sanctions against NSO Group and Candiru and Israeli export restrictions. For organizations protecting journalists, activists, and other high-risk personnel, the findings highlight the limits of relying on vendor assurances as protection against spyware targeting.
See the reporting duties and controls this puts on the clock.
7 events from the most recent confirmed update back to the earliest known activity.
Citizen Lab researchers confirmed that Paragon spyware had been used to target Italian activists and journalists.
The US Commerce Department sanctioned NSO Group and Candiru following reported misuse of their Pegasus and DevilsTongue spyware against government workers, journalists, dissidents, activists, and academics.
Former Unit 8200 commander Ehud Schneorson launched Paragon Solutions with three other Unit 8200 veterans and former Israeli Prime Minister Ehud Barak.
In an interview with WIRED, Paragon CEO Andrew Boyd said the company cannot determine whether customers misuse its software, lacks access to sensitive customer targeting logs, and has no kill switch to disable customers. Boyd defended the logging limitations as protecting customer privacy and said customer vetting is the primary safeguard against abuse.
Paragon pledged not to sell its mobile spyware to governments with poor human rights records and to cut off customers who misuse its products.
The Biden administration and Congress imposed guardrails intended to limit US government procurement of foreign commercial spyware posing national-security or foreign-government misuse risks.
Israel reduced the number of countries eligible to receive spyware exports from Israeli firms from 102 to 37. The restrictions excluded Saudi Arabia, the United Arab Emirates, Morocco, and Mexico.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
U.S. Immigration and Customs Enforcement confirmed to lawmakers that it bought and used Paragon Solutions spyware, including **Graphite**, in investigations tied to drug trafficking, fentanyl networks, and other organizations using encrypted communications. Acting ICE Director Todd Lyons said the deployment complied with constitutional requirements and the 2023 executive order restricting government use of commercial spyware, but House Democrats including **Rep. Summer Lee** said ICE had not provided enough documentation, safeguards, or oversight to justify such invasive surveillance. The disclosure followed the reactivation of ICE’s Paragon contract after an earlier suspension for review, and came amid wider controversy over reports linking Paragon spyware to targeting of journalists and activists. The admission intensified concerns that U.S. policy may be softening toward the commercial spyware industry even as evidence mounts that these vendors are driving serious cyber abuse. Reporting and research cited growing alarm over the lifting of sanctions on Intellexa executives, new U.S.-linked ownership of **NSO Group** and Paragon, and the expanding role of brokers, resellers, and other intermediaries that help spyware vendors evade export controls and obscure supply chains. Analysts also noted that Google attributed more zero-day exploitation to commercial surveillance vendors than to traditional state-backed groups in 2025, while lawmakers pressed for briefings on federal spyware use and U.S. investment in firms long associated with abuses involving **Pegasus**, **Predator**, and related surveillance tools.
Jun 29, 2026
Italian prosecutors are investigating a spyware scandal after **WhatsApp** and **Apple** alerted journalists, activists, and NGO workers that they had been targeted with mercenary spyware linked to **Paragon Solutions’ Graphite** platform. The campaign reportedly affected about 90 people worldwide, and public disclosures in Italy included journalist **Francesco Cancellato**, Fanpage journalist **Ciro Pellegrino**, and Mediterranea Saving Humans figures **Luca Casarini** and **Beppe Caccia**. Researchers at **Citizen Lab** later confirmed infections of Pellegrino and another European journalist, tying one case to a sophisticated zero-click **iMessage** exploit that Apple said was mitigated in `iOS 18.3.1`. The case has intensified scrutiny of Italy’s intelligence services after a parliamentary committee said agencies **AISI** and **AISE** were Paragon customers, even as the government denied targeting legally protected subjects such as journalists. Paragon said it had offered help investigating the alleged surveillance and later cut ties with Italy, but prosecutors in Rome and Naples reportedly have not received the company’s cooperation through formal channels, raising questions about accountability and Israeli assistance in spyware investigations. The dispute echoes earlier battles over Israeli spyware vendors, including **NSO Group’s Pegasus**, which was previously used in WhatsApp-based attacks and became the subject of major litigation and international scrutiny.
Jun 29, 2026
WhatsApp said it disrupted a **zero-click spyware campaign** that targeted about 90 users, including journalists and civil society members across more than two dozen countries, and linked the activity to Israeli spyware maker **Paragon**. The company said attackers used malicious PDF files sent through WhatsApp groups to compromise devices, patched the attack path, notified affected users, and sent Paragon a cease-and-desist letter. Researchers at Citizen Lab said they had also observed Paragon using the same vector, marking one of the first public cases tying the company to alleged surveillance of journalists and activists. The disclosure escalated into a political dispute in Italy after journalist **Francesco Cancellato** was identified among the targets. Paragon said it terminated contracts with Italian government customers after Rome refused its help in determining whether its **Graphite** spyware had been used unlawfully, while Italian officials said broader access to spyware logs would have exposed sensitive intelligence information and described the suspension as mutual. Italy’s parliamentary committee **COPASIR** said there was no evidence that intelligence agencies targeted Cancellato, though it confirmed the agencies were Paragon customers and found that some other individuals had been lawfully surveilled in investigations, intensifying scrutiny of Paragon’s claims that it operates as a more responsible spyware vendor.
Jun 29, 2026