Meta-owned WhatsApp has confirmed it disrupted a spyware campaign that targeted around 90 journalists and civil society members using surveillance technology from Israeli firm Paragon Solutions. The attack, neutralized in December 2024, involved zero-click exploits requiring no user interaction.
In a statement to The Guardian, WhatsApp said it had “high confidence” that the affected users were targeted and possibly compromised. The attack is suspected to have involved specially crafted PDF files sent to individuals in WhatsApp group chats. The targets were spread across more than two dozen countries, including several in Europe.
WhatsApp has notified affected users and provided guidance on enhancing their security. According to a WhatsApp spokesperson, this is the latest example of why spyware companies must be held accountable for their unlawful actions. They will continue to protect people’s ability to communicate privately.
Meta has sent Paragon Solutions a cease-and-desist letter and is exploring further legal actions. This marks the first public case linking Paragon’s spyware to human rights abuses.
Paragon Solutions develops surveillance software for government clients. Its flagship spyware, Graphite, is marketed as a tool for combating digital threats. The firm was acquired in December 2024 by U.S.-based AE Industrial Partners in a $500 million deal.
Meta’s disclosure comes shortly after a California judge ruled in WhatsApp’s favor in a lawsuit against NSO Group, which used WhatsApp infrastructure to deliver Pegasus spyware to 1,400 devices in May 2019.
The case highlights the growing misuse of commercial spyware and the need for stricter oversight of private surveillance firms.
Comments