jsr

NEW: foreign mercenary spyware is coming to the US.

ICE just quietly unsuspended contract with spyware maker #Paragon.

They got caught this year being used to hack journalists.

Friend, let me me bring you up to speed on why this is bad on multiple fronts.

YOUR BACKGROUND BRIEF:

#Paragon was co-founded in Israel in 2019 by ex head of Israel's NSA equivalent (Unit 8200) w/ major backing from former Israeli PM Ehud Barak.

Pitched themselves as stealthy & abuse-proof alternative to NSO Group's Pegasus.

The company has been trying to get into the US market for years.

For a long time all we knew about Paragon was their performance as a 'virtuous' spyware company with values.

All that came to a crashing halt in 2025 when they got very caught, helping customers hack targets across #WhatsApp.

WhatsApp did the right thing & notified users.

Almost immediately after the WhatsApp notifications, we started learning about the targets.

They weren't the supposed serious criminals... They were Journalists... human rights defenders...groups working on sea rescues.. etc

In other words, a very NSO-like scandal. https://blossom.primal.net/a530f88b24d07ffae346e2ed762a391f0e3908142a1aa2032a87bcfe0fb649b0.png
Ultimately Paragon & its Italian customer had a massive spyware scandal on their hands.

WhatsApp wasn't the only player tracking paragon & doing user notifications. Apple got in on the game.

Ultimately, we at the Citizen Lab had forensically analyzed cases from each notification round.

We testified to Italy's parliamentary intelligence oversight committee about our findings.

The conclusion? Deeply unsatisfactory.

Italy admitted hacking some targets, but denied hacking journalists. Tons of loose ends with Paragon. And they haven't been honest about who used their tech to hack journalists in Europe.

BIG PICTURE:

After 14 years investigating countless spyware companies, I tell you with confidence:

Mercenary spyware is a power abuse machine incompatible with American constitutional rights and freedoms.

Our legal system isn't designed for it, oversight mechanisms are woefully inadequate to protect our rights...

Here's the thing. You probably know that mercenary spyware like #Pegasus gets sold to dictators.

Who, predictably, abuse it.

But We have a growing pile of cases where spyware is sold to democracies... and then gets abused.

HISTORY LESSONS

History shows: secret surveillance usually winds up abused.

The history of the US is littered with surveillance abuses.

Thing is, our phones offer an unprecedented window into our lives.

Making zero-click mercenary spyware an especially grave risk to all our freedoms.

If the government has wants access to your accounts for law enforcement...they have to prepare a judicially authorized request and send it to the company, which reviews it.

Mercenary spyware bypasses any external review.

And the whole industry behind it seeks maximum obscurity.

COUNTERINTELLIGENCE THREATS? YEAH THAT TOO

I'm concerned about the impact on our rights an dour privacy.

But there's something else that should worry everybody about the choice to work with the company: Paragon poses a potentially grave counterintelligence threat to the US. Let me explain.

When you use an integrated spyware package to conduct sensitive law enforcement / intelligence business, you have to place a lot of trust in them...

If the developers originate from a foreign intelligence service that aggressively collects against the US government, that should be a huge red flag.

America (or any country) should be maximally wary about using foreign-developed surveillance tech for the same reason that America shouldn't operate a Chinese-made stealth fighter.

So, have Paragon's spyware, people & ops been aggressively vetted for technical and human counterintelligence risks?

MERCENARY SPYWARE = FATE SHARING Paragon's #Graphite mercenary spyware shares the same downsides as other products in their class:

❌They keep getting caught

We researchers aren't the only ones that have found techniques for tracking and identifying Paragon spyware... I'm sure hostile govs have too.

❌Customers fate share.

Since all customers roll the same tech, when one gets caught it impacts & potentially exposes everyones' activities.

Now, that fate sharing will include US law enforcement activity.

WHAT CAN YOU DO?

What can you do? Take 5 minutes and call your member of Congress.

Ask them to request a briefing on Paragon.

They should ask whether the company was properly vetted & reviewed.

What is the oversight mechanism for this maximally invasive technology?

What are the guardrails? How would abuses be handled? Etc.

PERSONAL SECURITY?

Paragon & this category of spyware is fiendishly hard to track & defend against.

And on a personal level? Apple's Lockdown Mode & Android Advanced Protection both offer some serious security benefits but neither is a silver bullet..

Unfortunately, as of right now I am pretty confident that no publicly available / commercially developed third party tool can reliably detect Paragon spyware either in realtime. Or retrospectively.

Beware a false sense of security.

If you got this far & found this post useful, let me know! Drop a comment.

SELECTED READING LIST

Exclusive: ICE reactivated its $2 million contract with Israeli spyware firm Paragon, following its acquisition by U.S. capital

https://jackpoulson.substack.com/p/exclusive-ice-has-reactivated-its

Virtue or Vice? A First Look at Paragon’s Proliferating Spyware Operations

https://citizenlab.ca/2025/03/a-first-look-at-paragons-proliferating-spyware-operations/

Graphite Caught First Forensic Confirmation of Paragon’s iOS Mercenary Spyware Finds Journalists Targeted

https://citizenlab.ca/2025/06/first-forensic-confirmation-of-paragons-ios-mercenary-spyware-finds-journalists-targeted/

🚨NEW INVESTIGATION: We just forensically unmasked #Paragon 's Apple spyware.

Zero-click targets: Journalists. In 🇪🇺Europe.

Like 🇮🇹Italian reporter Ciro Pellegrino

Reopen's #Italy's spyware scandal.

Follows our earlier Citizenlab investigation of Paragon Android spyware.

BACKGROUND

Back in April, #Apple sent out a threat notification to a select group of users. Some got in touch with us to get analyzed.

WHAT WE FOUND

They'd been targeted with a sophisticated zero-click attack (think: no click, no attachment to open, no mistake needed...).

While my brilliant colleague Bill Marczak was working on the phone of a prominent European journalist, he made a smoking gun discovery:

Requests to server matching our P1 fingerprint for #Paragon's graphite.

Paragon's 'undetectable' Apple spyware had just been found... Just as we'd found their Android spyware some months ago.

The prominent European journalist had another spicy indicator on their iPhone logs:

An iMessage account belonging to a particular #Paragon customer...used to deploy this zero-click attack.

We call this account ATTACKER1. We'd find them again in short order...

Earlier this year we uncovered #Paragon's Android spyware after #WhatsApp notified a group of users they'd been targeted with Paragon.

One of the notification recipients? Journalist Francesco Cancellato

His outlet http://fanpage.it had done bombshell reporting that displeased the Italian government.

Then, in April, his colleague Ciro Pellegrino also gets a notification.

His is from Apple (Cannot overstate how helpful these notifications are)

We analyze Ciro's iPhone & forensically confirm he's a Paragon target.

And we find the ATTACKER1 iMessage account again!

ITALIAN DRAMA This week #Paragon and #Italy have been locking horns over the case of Francesco Cancellato. Paragon doesn't want to be stuck w/unexplained abuses against journalists.

I think Paragon likely want to be able put to it on a customer & wash hands...

But when your customer is a government... they clap back. So Italy has been threatening to declassify things like Paragon's testimony to their intelligence oversight committee. Spicy.

BIG QUESTION

We're left with a big question: who's hacking European journalists with Paragon?

Who targeted Francesco & Ciro?

Right now they have no answers.

Bad look for Paragon. Bad look for Italy.

Curious what Paragon knows about that server...

BIG PICTURE Paragon's marketing was the 'clean' & stealthy opposite of NSO Group.

Yet Paragon's Apple and Android tech got caught.

And they can't shake a spyware abuse scandal.

Conclusion: the problem isn't just a few bad apples, abuse is axiomatic.

And discovery is a matter of time.

APPLE USERS: One bit of good news, Apple tells us that the zero-click attack deployed in these cases was mitigated as of iOS 18.3.1.

That's #CVE-2025-43200 for the curious.

Make sure to keep your iPhones up to date. And get in touch if you get one of these advanced threat notifications.

OUR FULL REPORT: https://citizenlab.ca/2025/06/first-forensic-confirmation-of-paragons-ios-mercenary-spyware-finds-journalists-targeted/

BREAKING: jury awards massive $167 million in punitive damages against spyware company NSO Group.

It turns out that the regular people on a jury think it is evil when you help dictators hack dissidents.

After years of every trick & delay tactic it only took a California jury ONE DAY of deliberation to get this Monsanto-scale verdict. Precedent-setting win against notorious #Pegasus spyware maker.

BACKSTORY: Rewind to 2019. About this time (April-May) #WhatsApp catches NSO Group hacking its users with #Pegasus.

They investigated.

We at Citizen Lab helped to investigate the targets & get in touch with the activists journalists & civil society members that were targeted

We identified at least 100. And got in touch. It was a tremendous push of sleepless days. But it made it so clear just how much harm was being done.

Then, In October 2019 WhatsApp sued.

Prior to the lawsuit, NSO had acted the playground bully.

Targeting victims that dared speak up & researchers like us.

Suddenly, the bully wasn't so surefooted. Like the scene in a high school movie where the cousin shows up in the beat up car & collars the bully.

You might not remember, but in 2019 no country had sanctioned NSO Group... No parliamentary hearings, no hearings in congress, no serious investigations.

For years, WhatsApp's lawsuit helped carry momentum & showed governments that their tech sectors were in the crosshairs from mercenary spyware too...

Credit due to Meta & WhatsApp leadership on this one, they stuck the fight out & carried it across the finish line.

NOTIFICATIONS MATTER

WhatsApp's choice to notify targets was also hugely consequential.

A lot of cases were first surfaced from these notifications.

With dissidents around the world suddenly learning that dictators were snooping in their phones...with NSO Group's help.

A SIDEBAR: HARASSING RESEARCHERS

One of NSO's many tactics was to leverage the case to badger me & us Citizen Lab researchers to try and extract information.

It never worked, but it laid bare the tactics that these firms prefer...instead of coming clean.

ROLE OF CIVIL SOCIETY Ultimately, we wouldn't be here without civil society investigations of mercenary spyware... and alarm raising.

And victims choosing to come forwads.

Thankfully today there's a whole accountability ecosystem growing around this work.

Dozens of orgs engaging.

Numbers are growing.

IS THERE GONNA BE IMPACT? YES

NSO Group emerges from the trial severely damaged.

The damages ($167,254,000 punitive, $440K+ compensatory) is big enough to make your eyes water.

NSO'S BUSINESS IS NOW ALL OVER THE NET

The case is also a blow to NSO's secrecy, with their business splashed all over a courtroom.

WhatsApp just published NSO's depositions, exposing an unprecedented amount of info on a spyware company's operations:

✅https://about.fb.com/wp-content/uploads/2025/05/WhatsApp-v-NSO-Eshkar-Transcrips_Case-4-19-cv-07123-PJH.pdf ✅https://about.fb.com/wp-content/uploads/2025/05/WhatsApp-v-NSO-Gil-Transcrips_Case-4-19-cv-07123-PJH.pdf ✅https://about.fb.com/wp-content/uploads/2025/05/WhatsApp-v-NSO-Shohat-Transcrips_Case-4-19-cv-07123-PJH.pdf ✅https://about.fb.com/wp-content/uploads/2025/05/WhatsApp-v-NSO-Gazneli-Transcrips_Case-4-19-cv-07123-PJH.pdf

This will scare customers. And investors. And other companies that do the same thing. Good.

MY VIEW: Watching a jury of regular citizens see right through NSO's mendacity & hypocrisy...and to the need to protect privacy is amazing.

Gives me hope.

Despite all the fancy lawyering & lobbying, people know that this kind of privacy invasion is wrong.

Read more: They Exposed an Israeli Spyware Firm. Now the Company Is Badgering Them in Court. https://theintercept.com/2024/05/06/pegasus-nso-group-israeli-spyware-citizen-lab/

Spyware maker NSO ordered to pay $167 million for hacking WhatsApp

https://www.washingtonpost.com/technology/2025/05/06/nso-pegasus-whatsapp-damages/

NSO Group must pay more than $167 million in damages to WhatsApp for spyware campaign https://techcrunch.com/2025/05/06/nso-group-must-pay-more-than-167-million-in-damages-to-whatsapp-for-spyware-campaign/

NEW: Italian gov reportedly admits it targeted activists with #Paragon mercenary spyware.

After ~2 months that began with denials & slid into evasions, some clarity finally came. But only some...

The spyware targeting of journalist Francesco Cancellato, the first case to come forwards after he got notified by #WhatsApp at the end of January is still unexplained.

We at #Citizenlab have been investigating the case & working with targets. We published a forensic investigation last week. Lots of unanswered questions.

Company Background: Company frames themselves as the anti-NSO Group (the notorious Israeli spyware company that makes Pegasus spyware). More stealthy. More ethical. Well, they got caught & they now have a big scandal.

Like NSO, Paragon also originates out of alumni from the Israeli intelligence community but was recently acquired by a US defense contractor.

Up Next? As long as clarity is incomplete... the #Paragon scandal isn't going away for #Italy ... and Italy is going to remain a major pain for the mercenary spyware company.

Report: https://www.euractiv.com/section/politics/news/spyware-scandal-italian-government-reportedly-admits-targeting-activists/

https://primal.net/e/nevent1qqs8us77wawnjryeacpq0cup22pvwdnhyv6k69fmkadf5r34rppp7usyhlr4e

🚨NEW REPORT: first forensic confirmation of #Paragon mercenary spyware infections in #Italy...

Known targets: Activists & journalists.

We also found deployments around the world. Including ...Canada?

https://m.primal.net/Pljg.png https://m.primal.net/Plji.png

So #Paragon makes zero-click spyware marketed as better than NSO's Pegasus...

Harder to find... https://m.primal.net/Pljo.png

...And more ethical too!

This caught our attention at #Citizenlab. And we were skeptical. https://m.primal.net/Pljq.png

So.. it was time to start digging. https://m.primal.net/Pljr.png

We got a tip about a single bit of #Paragon infrastructure & my brilliant colleague Bill Marczak developed a technique to fingerprint some of the mercenary spyware infrastructure (both victim-facing & customer side) globally. https://m.primal.net/Pljv.png So much for invisibility.

What we found startled us.

We found a bunch of apparent deployments of Paragon's mercenary spyware in places like #Australia, #Denmark, #Israel, #Cyprus #Singapore and... #Canada.

Fun. https://m.primal.net/Pljz.png

We also found interesting stuff at a datacenter in #Germany https://m.primal.net/PlkB.png

Caveats: the methodology we use only surfaces a subset of customers at a particular time.

So ...about #Canada.

My colleagues on the legal side began digging. The more they pulled, the more questions surfaced about whether the Ontario Provincial Police is rolling mercenary spyware. https://m.primal.net/PlkJ.png

While investigating, we found signs #WhatsApp was being used as a vector for infections.

We shared our analysis with Meta which had an ongoing investigation into Paragon.

They shared findings with WhatsApp which discovered & mitigated a zero-click attack.

They went public, and notified ~90 users that they believed were targeted.

WhatsApp's notifications to targets turbocharged what we all knew about #Paragon.

Cases began coming out: an investigative journalist in #Italy and sea rescue activists were among the first. Francesco Cancellato. Editor in Chief of Fanpage.it, & Luca Casarini and Dr. Giuseppe “Beppe” Caccia of Mediterranea Saving Humans

They consented to us doing a forensic analysis... https://m.primal.net/Plkc.png

Sure enough, we found traces of infection on several Androids.

We call the indicator #BIGPRETZEL & #WhatsApp confirms that they believe BIGPRETZEL is associated with #Paragon's spyware.

In the weeds a bit: Android log forensics are tricky. Logs get overwritten fast, are captured sporadically & may not go back very far. So, not finding BIGPRETZEL on a targeted phone wouldn't be enough to say it wasn't infected. In such a case, the only safe course of action for a notified Paragon target would be to presume they had been infected.

Our analysis is ongoing.

.... but There's more!

There's more! We'd been analyzing the iPhone of human rights activist David Yambio, who is focused on abuses against migrants in Libya (they are often victims of torture, trafficking, and killings) who works closely with the other targets. https://m.primal.net/Plki.png

Last year he got notified by Apple that he was targeted with sophisticated spyware.

We've forensically confirmed the infection & shared details with Apple.

Apple confirms they fixed the vectors used to target him as of iOS 18.

We're not doing a full technical attribution of this novel spyware to a particular company yet. But it's not like anything we've seen.

Troublingly, timeline of David's spyware targeting lines up with when he was providing information to the International Criminal Court about torture by human traffickers in #Libya.

But there's even more spying afoot against this cluster of activists!

Luca also got a notification last February about targeting with a different kind of surveillance tech. https://m.primal.net/Plkp.png

He wasn't alone. Father Mattia Ferrari, chaplain of Luca's lifesaving organization' also got a notification.

#Italy's response to the unfolding #Paragon scandal has been exceptionally chaotic. So we included a little timeline.

Denials, then admissions, then refusals to say more citing secrecy. https://m.primal.net/Plks.png

Honestly, deja vu of how Pegasus-abusing governments have handled PR...

TAKEAWAYS:

TAKEAWAY 1: you can't abuse-proof mercenary spyware. Selling just democracies won't prevent abuses. Most democracies have plenty of historic examples of surveillance abuses. Why should spyware be different?

TAKEAWAY 2: #Paragon's technical tradeoffs to be less detectable didn't prevent them getting discovered.

Just made it harder.

TAKEAWAY 3: I think we're only looking at the tip the #Paragon hackberg

For example, the ~90 notification number from #WhatsApp only represents 1 infection vector that got caught & notified.

There may be non-notified spyware victims walking around right now who were infected via a different mechanism.

In #Italy, too we also need to better understand the other surveillance technologies pointed at this cluster of people.

Finally, we gave #Paragon room to respond to a summary of our key findings.

Their US Executive Chairman, a 30+ year #CIA veteran, responded in a way that sounded very familiar to how NSO Group did PR.

1 - Say there are inaccuracies.. 2- ..But refuse to specify them 3-Cite customer confidentiality as a reason to not say more.

We welcome any clarifications they have now that they've read our full report.

FINAL NOTES: our #citizenlab investigations are usually big, collaborative team productions. Smart co-authors, awesome collaborators. https://m.primal.net/PllG.png

The key to nearly all our research into spyware is targets' brave choice to speak out.

And work with us to forensically analyze their devices... We are very grateful to them.

This is how we collectively get a better understanding of mercenary spyware abuses.

And journey towards accountability.

Thanks for reading! Drop questions in the replies!

READ THE FULL REPORT https://citizenlab.ca/2025/03/a-first-look-at-paragons-proliferating-spyware-operations/

BREAKING: NSO Group liable for #Pegasus hacking of #WhatsApp users.

Big win for #spyware victims.

Big loss for NSO.

Bad time to be a spyware company.

Landmark case. Huge implications.

Here's the story1/

https://m.primal.net/NCJj.png https://m.primal.net/NCJl.png https://m.primal.net/NCJm.png https://m.primal.net/NCJn.png