Skip to Content
logologo
AI Incident Database
Open TwitterOpen RSS FeedOpen FacebookOpen LinkedInOpen GitHub
Open Menu
Discover
Submit
  • Welcome to the AIID
  • Discover Incidents
  • Spatial View
  • Table View
  • List view
  • Entities
  • Taxonomies
  • Submit Incident Reports
  • Submission Leaderboard
  • Blog
  • AI News Digest
  • Risk Checklists
  • Random Incident
  • Sign Up
Collapse
Discover
Submit
  • Welcome to the AIID
  • Discover Incidents
  • Spatial View
  • Table View
  • List view
  • Entities
  • Taxonomies
  • Submit Incident Reports
  • Submission Leaderboard
  • Blog
  • AI News Digest
  • Risk Checklists
  • Random Incident
  • Sign Up
Collapse

Incident 1069: Purported Graphite Spyware Linked to Paragon Solutions Allegedly Deployed Against Journalists and Civil Society Workers

Description: Researchers at Citizen Lab and Censys reportedly identified spyware infections involving Graphite, a tool attributed to Israeli firm Paragon Solutions. The spyware was allegedly deployed against civil society actors, including journalists and aid workers, through a zero-click WhatsApp exploit. WhatsApp notified over 90 targeted individuals. Evidence reportedly suggests deployments in multiple democratic countries.
Editor Notes: For the full report by Citizen Lab, please visit this URL: https://citizenlab.ca/2025/03/a-first-look-at-paragons-proliferating-spyware-operations/. Timeline notes: WhatsApp reportedly notified over 90 individuals of targeting with Paragon spyware on January 31, 2025. Subsequent investigation by Citizen Lab and Censys, published on March 19, 2025, identified additional infrastructure and implicated law enforcement agencies in multiple democratic countries. This record uses January 31, 2025 as the incident date based on first confirmed exposure.

Tools

New ReportNew ReportNew ResponseNew ResponseDiscoverDiscoverView HistoryView History

Entities

View all entities
Alleged: REDLattice and Paragon Solutions developed an AI system deployed by York Regional Police Service (Ontario, Canada) , Unidentified law enforcement or intelligence entity (Singapore) , Unidentified law enforcement or intelligence entity (Israel) , Unidentified law enforcement or intelligence entity (Denmark) , Unidentified law enforcement or intelligence entity (Cyprus) , Unidentified law enforcement or intelligence entity (Australia) , Peel Regional Police (Ontario, Canada) , Ontario Provincial Police , Hamilton Police Service (Ontario, Canada) , External Intelligence and Security Agency , AISE and Agenzia Informazioni e Sicurezza Esterna, which harmed Refugees in Libya , Mediterranea Saving Humans , Luca Casarini , Journalists , Humanitarian workers , Giuseppe "Beppe" Caccia , General public of countries in which Graphite is being deployed , Francesco Cancellato , Fanpage.it , David Yambio , Civil society workers and Activists.
Alleged implicated AI systems: WhatsApp , iOS , Graphite (Paragon spyware) , Cloudflare and Android

Incident Stats

Incident ID
1069
Report Count
30
Incident Date
2025-01-31
Editors
Daniel Atherton

Incident Reports

Reports Timeline

+5
WhatsApp says journalists and civil society members were targets of Israeli spyware
+5
WhatsApp says Paragon is spying on specific users
Israeli spyware Graphite allegedly hacks messaging app servers instead of devicesThe spyware challenge: the paragon casePegasus and other spyware tools: rising threats of government and criminal surveillance+10
Virtue or Vice? A First Look at Paragon’s Proliferating Spyware Operations
+3
Nation-State 'Paragon' Spyware Infections Target Civil Society
Paragon Spyware Attacks Exploited WhatsApp Zero-Day
WhatsApp says journalists and civil society members were targets of Israeli spyware

WhatsApp says journalists and civil society members were targets of Israeli spyware

theguardian.com

‘Zero-Click’ Hack – WhatsApp Takes Action against Israeli ‘Paragon’ for Spying on Users

‘Zero-Click’ Hack – WhatsApp Takes Action against Israeli ‘Paragon’ for Spying on Users

palestinechronicle.com

WhatsApp accuses Paragon of targeting about 90 users with spyware

WhatsApp accuses Paragon of targeting about 90 users with spyware

therecord.media

WhatsApp says Israeli spyware company Paragon targeted scores of users

WhatsApp says Israeli spyware company Paragon targeted scores of users

timesofisrael.com

WhatsApp disrupted a hacking campaign targeting journalists with Paragon spyware

WhatsApp disrupted a hacking campaign targeting journalists with Paragon spyware

securityaffairs.com

WhatsApp says Paragon is spying on specific users

WhatsApp says Paragon is spying on specific users

malwarebytes.com

'A historic battle': Israeli cyber firm Paragon ready to face Meta in court

'A historic battle': Israeli cyber firm Paragon ready to face Meta in court

ynetnews.com

Paragon Spyware Allegedly Ends Spyware Contract with Italy

Paragon Spyware Allegedly Ends Spyware Contract with Italy

gbhackers.com

Owner of spyware used in alleged WhatsApp breach ends contract with Italy

Owner of spyware used in alleged WhatsApp breach ends contract with Italy

theguardian.com

Israeli Spyware Firm Paragon Cuts Italy's Access After Journalists Targeted

Israeli Spyware Firm Paragon Cuts Italy's Access After Journalists Targeted

haaretz.com

Israeli spyware scandal: Paragon’s Graphite used to target Italian journalists and critics

Israeli spyware scandal: Paragon’s Graphite used to target Italian journalists and critics

middleeastmonitor.com

Israeli spyware Graphite allegedly hacks messaging app servers instead of devices

Israeli spyware Graphite allegedly hacks messaging app servers instead of devices

turkiyetoday.com

The spyware challenge: the paragon case

The spyware challenge: the paragon case

iari.site

Pegasus and other spyware tools: rising threats of government and criminal surveillance

Pegasus and other spyware tools: rising threats of government and criminal surveillance

cybernews.com

Virtue or Vice? A First Look at Paragon’s Proliferating Spyware Operations

Virtue or Vice? A First Look at Paragon’s Proliferating Spyware Operations

citizenlab.ca

Europe: Paragon attacks highlight Europe’s growing spyware crisis

Europe: Paragon attacks highlight Europe’s growing spyware crisis

amnesty.org

Six additional countries identified as suspected Paragon spyware customers

Six additional countries identified as suspected Paragon spyware customers

cyberscoop.com

WhatsApp patched zero-click flaw exploited in Paragon spyware attacks

WhatsApp patched zero-click flaw exploited in Paragon spyware attacks

bleepingcomputer.com

Canadian provincial police appear to be using advanced commercial spyware

Canadian provincial police appear to be using advanced commercial spyware

therecord.media

Researchers name six countries as likely customers of Paragon's spyware

Researchers name six countries as likely customers of Paragon's spyware

techcrunch.com

Rights advocates raise concerns over Paragon spyware use against journalists and activists in Europe

Rights advocates raise concerns over Paragon spyware use against journalists and activists in Europe

jurist.org

Six Governments Likely Use Israeli Paragon Spyware to Hack IM Apps and Harvest Data

Six Governments Likely Use Israeli Paragon Spyware to Hack IM Apps and Harvest Data

thehackernews.com

WhatsApp fixed zero-day flaw used to deploy Paragon Graphite spyware

WhatsApp fixed zero-day flaw used to deploy Paragon Graphite spyware

securityaffairs.com

Israeli Spyware Graphite Targeted WhatsApp with 0-Click Exploit

Israeli Spyware Graphite Targeted WhatsApp with 0-Click Exploit

hackread.com

Paragon Scandal: Denmark And Cyprus Potential Spyware Customers Alongside Italy

Paragon Scandal: Denmark And Cyprus Potential Spyware Customers Alongside Italy

eurasiareview.com

Nation-State 'Paragon' Spyware Infections Target Civil Society

Nation-State 'Paragon' Spyware Infections Target Civil Society

darkreading.com

What to know about Israeli spyware allegedly used by Ontario police

What to know about Israeli spyware allegedly used by Ontario police

globalnews.ca

Report on Paragon Spyware

Report on Paragon Spyware

securityboulevard.com

Research links Paragon spyware to new government clients

Research links Paragon spyware to new government clients

scworld.com

Paragon Spyware Attacks Exploited WhatsApp Zero-Day

Paragon Spyware Attacks Exploited WhatsApp Zero-Day

securityweek.com

WhatsApp says journalists and civil society members were targets of Israeli spyware
theguardian.com · 2025

Nearly 100 journalists and other members of civil society using WhatsApp, the popular messaging app owned by Meta, were targeted by spyware owned by Paragon Solutions, an Israeli maker of hacking software, the company alleged on Friday.

The…

‘Zero-Click’ Hack – WhatsApp Takes Action against Israeli ‘Paragon’ for Spying on Users
palestinechronicle.com · 2025

WhatsApp has accused Israeli spyware company Paragon Solutions of targeting nearly 100 journalists and civil society members.

WhatsApp has accused Israeli spyware company Paragon Solutions of targeting nearly 100 journalists and civil socie…

WhatsApp accuses Paragon of targeting about 90 users with spyware
therecord.media · 2025

WhatsApp on Friday accused the commercial surveillance company Paragon of targeting about 90 of its users with spyware.

The Meta-owned messaging platform said it believes the targets include journalists and members of civil society. The com…

WhatsApp says Israeli spyware company Paragon targeted scores of users
timesofisrael.com · 2025

An official with Meta's popular WhatsApp chat service has said Israeli spyware company Paragon Solutions targeted scores of its users, including journalists and members of civil society.

The official said on Friday that WhatsApp had sent Pa…

WhatsApp disrupted a hacking campaign targeting journalists with Paragon spyware
securityaffairs.com · 2025

Meta announced that discovered and dismantled a malware campaign via WhatsApp that targeted journalists and civil society members with the Paragon spyware (aka Graphite).

The hacking campaign targeted 90 users and was disrupted in December,…

WhatsApp says Paragon is spying on specific users
malwarebytes.com · 2025

WhatsApp has accused the professional spyware company Paragon of spying on a select group of users.

WhatsApp, the Meta-owned, end-to-end encrypted messaging platform, said it has reliable information that nearly 100 journalists and other "m…

'A historic battle': Israeli cyber firm Paragon ready to face Meta in court
ynetnews.com · 2025

The battle between social media giant Meta and Israeli offensive cyber firm Paragon has intensified. Following reports that Meta's subsidiary WhatsApp sent a cease-and-desist letter to Paragon, demanding it stop spying on its users, Ynet le…

Paragon Spyware Allegedly Ends Spyware Contract with Italy
gbhackers.com · 2025

Paragon Solutions, an Israeli cybersecurity firm, has reportedly ended its spyware contract with Italy.

The termination comes in the wake of revelations that its military-grade hacking software, Graphite, was allegedly used to target 90 ind…

Owner of spyware used in alleged WhatsApp breach ends contract with Italy
theguardian.com · 2025

Paragon Solutions, whose military-grade hacking software was allegedly used to target 90 people, including journalists and members of civil society, in two dozen countries, has terminated its client relationship with Italy, according a pers…

Israeli Spyware Firm Paragon Cuts Italy's Access After Journalists Targeted
haaretz.com · 2025

The Israeli spyware maker Paragon has terminated its dealings with Italy, including disconnecting its access to Graphite, a military-grade surveillance technology capable of hacking into encrypted smartphones.

The decision follows allegatio…

Israeli spyware scandal: Paragon’s Graphite used to target Italian journalists and critics
middleeastmonitor.com · 2025

n yet another scandal involving Israeli spyware being misused to target journalists, Paragon Solutions has reportedly terminated access to its clients in Italy following allegations that its military-grade hacking software was used to targe…

Israeli spyware Graphite allegedly hacks messaging app servers instead of devices
turkiyetoday.com · 2025

Israeli cybersecurity firm Paragon, founded by Israel's former Prime Minister Ehud Barak, is facing allegations that its Graphite spyware exploits vulnerabilities in the servers of messaging apps such as WhatsApp, Telegram, and Signal to co…

The spyware challenge: the paragon case
iari.site · 2025

An analysis of the Paragon case in light of previous episodes of AI usage for surveillance purposes and of the Italian and European legislation on data protection.

The Paragon case 

On 31 January 2025, WhatsApp sent a notification to at lea…

Pegasus and other spyware tools: rising threats of government and criminal surveillance
cybernews.com · 2025

Spyware acquired by governments is increasingly threatening civilians. While sophisticated spyware attacks may be very difficult to avoid, practicing basic internet hygiene and staying vigilant can help to minimize the risks.

In February, t…

Virtue or Vice? A First Look at Paragon’s Proliferating Spyware Operations
citizenlab.ca · 2025

AIID editor's note: Please read the original source for the full report. It can be accessed here: https://citizenlab.ca/2025/03/a-first-look-at-paragons-proliferating-spyware-operations/.

Key Findings

  • Introducing Paragon Solutions. Parago…

Europe: Paragon attacks highlight Europe’s growing spyware crisis
amnesty.org · 2025

Responding to the publication of a Citizen Lab report identifying multiple cases involving the use of Paragon's spyware against journalists and human rights defenders in Italy, the Head of Amnesty International's Security Lab, Donncha Ó Cea…

Six additional countries identified as suspected Paragon spyware customers
cyberscoop.com · 2025

Researchers have identified suspected government customers of spyware company Paragon Solutions in six more countries that hadn't previously been publicly identified, according to a report published Wednesday.

The University of Toronto's Ci…

WhatsApp patched zero-click flaw exploited in Paragon spyware attacks
bleepingcomputer.com · 2025

WhatsApp has patched a zero-click, zero-day vulnerability used to install Paragon's Graphite spyware following reports from security researchers at the University of Toronto's Citizen Lab.

The company addressed the attack vector late last y…

Canadian provincial police appear to be using advanced commercial spyware
therecord.media · 2025

There is evidence suggesting that Canadian provincial police are using powerful advanced commercial spyware, the Citizen Lab said in a report released Wednesday.

The internet protocol address of a spyware customer detected by the Citizen La…

Researchers name six countries as likely customers of Paragon's spyware
techcrunch.com · 2025

The governments of Australia, Canada, Cyprus, Denmark, Israel, and Singapore are likely customers of Israeli spyware maker Paragon Solutions, according to a new technical report by a renowned digital security lab.

On Wednesday, The Citizen …

Rights advocates raise concerns over Paragon spyware use against journalists and activists in Europe
jurist.org · 2025

Amnesty International on Wednesday condemned the extensive use of Paragon Solutions' Graphite spyware to target journalists and human rights defenders in Europe, and called for urgent regulatory action to protect civil liberties. The condem…

Six Governments Likely Use Israeli Paragon Spyware to Hack IM Apps and Harvest Data
thehackernews.com · 2025

The governments of Australia, Canada, Cyprus, Denmark, Israel, and Singapore are likely customers of spyware developed by Israeli company Paragon Solutions, according to a new report from The Citizen Lab.

Paragon, founded in 2019 by Ehud Ba…

WhatsApp fixed zero-day flaw used to deploy Paragon Graphite spyware
securityaffairs.com · 2025

WhatsApp has addressed a zero-click, zero-day vulnerability exploited to install Paragon's Graphite spyware on the devices of targeted individuals.

WhatsApp blocked a spyware campaign by Paragon targeting journalists and civil society membe…

Israeli Spyware Graphite Targeted WhatsApp with 0-Click Exploit
hackread.com · 2025

Cybersecurity researchers at the Citizen Lab at the University of Toronto have exposed the use of sophisticated spyware named Graphite, developed by the Israeli firm Paragon Solutions, to target high-profile individuals through WhatsApp.

Th…

Paragon Scandal: Denmark And Cyprus Potential Spyware Customers Alongside Italy
eurasiareview.com · 2025

(EurActiv) --- Paragon Solutions, the Israeli company behind Graphite spyware, appears to be active in more EU countries than it has been previously known, according to a new report published today.

Revelations confirmed by WhatsApp in Janu…

Nation-State 'Paragon' Spyware Infections Target Civil Society
darkreading.com · 2025

Researchers are beginning to unravel global surveillance operations targeting journalists, humanitarian aid workers, and other civilians via messaging apps.

On Jan. 31, WhatsApp contacted more than 90 individuals whom it believed had been t…

What to know about Israeli spyware allegedly used by Ontario police
globalnews.ca · 2025

Researchers behind a new report into an Israeli spyware program used to monitor civil society members say they have found "possible links" between the controversial technology and Ontario Provincial Police (OPP), suggesting it may have been…

Report on Paragon Spyware
securityboulevard.com · 2025

Citizen Lab has a new report on Paragon’s spyware:

Key Findings:

  • Introducing Paragon Solutions. Paragon Solutions was founded in Israel in 2019 and sells spyware called Graphite. The company differentiates itself by claiming it has safegu…
Research links Paragon spyware to new government clients
scworld.com · 2025

A new report by the University of Torontos Citizen Lab has identified suspected government customers of Paragon Solutions spyware in six additional countries: Australia, Canada, Cyprus, Denmark, Israel, and Singapore, according toCyberScoop…

Paragon Spyware Attacks Exploited WhatsApp Zero-Day
securityweek.com · 2025

The Citizen Lab research group at the University of Toronto has conducted an analysis of attacks involving spyware developed by Israeli company Paragon Solutions, which led to the discovery of a zero-day vulnerability in Meta's WhatsApp com…

Variants

A "variant" is an AI incident similar to a known case—it has the same causes, harms, and AI system. Instead of listing it separately, we group it under the first reported incident. Unlike other incidents, variants do not need to have been reported outside the AIID. Learn more from the research paper.
Seen something similar?
Previous IncidentNext Incident

Research

  • Defining an “AI Incident”
  • Defining an “AI Incident Response”
  • Database Roadmap
  • Related Work
  • Download Complete Database

Project and Community

  • About
  • Contact and Follow
  • Apps and Summaries
  • Editor’s Guide

Incidents

  • All Incidents in List Form
  • Flagged Incidents
  • Submission Queue
  • Classifications View
  • Taxonomies

2024 - AI Incident Database

  • Terms of use
  • Privacy Policy
  • Open twitterOpen githubOpen rssOpen facebookOpen linkedin
  • b3bc8e7