Summary:
Last Friday, Meta-owned WhatsApp, a popular messaging platform, stated it disrupted a spyware campaign back in December 2024, targeting journalists and civil society members. In total, 90 individuals were targeted and possibly compromised in the latest campaign, which WhatsApp asserts with high confidence. According to the company, these individuals were targeted by spyware owned by Paragon Solutions, an Israeli maker of hacking software. Paragon's spyware, Graphite, is similar to NSO Group's Pegasus and grants operators full access to infected phones. This includes the ability to read messages via encrypted apps like WhatsApp and Signal.

Security Officer Comments:
The attacks were conducted via a "zero-click" exploit, meaning no user interaction was required for infection. WhatsApp stated the infection likely spread through a malicious PDF sent to individuals added to group chats. As of writing, the campaign has yet to be attributed to a known adversary, nor is it clear how long the perpetrators were able to gain access to the targeted devices.

Paragon's hacking software is typically used by government clients, though WhatsApp has not identified who ordered the attacks. A source close to Paragon stated the company has 35 government customers, all considered democratic, and does not do business with countries previously accused of misusing spyware, such as Greece, Poland, Hungary, Mexico, and India.

Suggested Corrections:
WhatsApp says it is currently reaching out to the affected users and has further sent Paragon a “cease and desist” letter, stating that it is exploring its legal options. In general, to defend against such attacks, users should regularly update their devices with the latest security patches, refrain from opening attachments or links from unknown senders, ensure that software is installed only from trusted sources, and implement antivirus solutions in place to detect and prevent the deployment of malicious payloads.

Link(s):
https://www.theguardian.com/technology/2025/jan/31/whatsapp-israel-spyware