An official from Meta Platforms’ widely-used WhatsApp chat service revealed that the Israeli spyware company Paragon Solutions had targeted numerous WhatsApp users, including journalists and members of civil society. The official stated on Friday that WhatsApp had issued a cease-and-desist letter to Paragon following the hack. In a statement, WhatsApp emphasized its commitment to safeguarding users’ ability to communicate privately.
Paragon declined to comment on the allegations. The WhatsApp official disclosed that the company had detected an attempt to hack approximately 90 users. While the official did not specify the identities of those targeted, they confirmed that the affected individuals were located in more than two dozen countries, including several in Europe. The attackers reportedly sent malicious electronic documents to WhatsApp users, exploiting a zero-click hack method that requires no user interaction to compromise devices, making it particularly stealthy.
WhatsApp has since disrupted the hacking attempt and is referring the affected targets to Citizen Lab, a Canadian internet watchdog group. The official did not elaborate on how WhatsApp determined Paragon’s involvement in the hack but noted that law enforcement and industry partners had been informed. However, no further details were provided.
The FBI did not immediately respond to a request for comment on the matter.
John Scott-Railton, a researcher at Citizen Lab, commented that the discovery of Paragon’s spyware targeting WhatsApp users highlights the ongoing proliferation of mercenary spyware and its problematic use. Spyware companies like Paragon sell advanced surveillance tools to government clients, often marketing their services as essential for combating crime and ensuring national security. However, such tools have repeatedly been found on the devices of journalists, activists, opposition politicians, and at least 50 U.S. officials, raising concerns about the unchecked spread of this technology.
Paragon, which was reportedly acquired last month by Florida-based investment group AE Industrial Partners, has sought to portray itself as a more responsible player in the industry. Its website promotes “ethically based tools, teams, and insights to disrupt intractable threats,” and media reports citing sources familiar with the company claim that Paragon only sells to governments in stable democratic countries.
Natalia Krapiva, senior tech-legal counsel at the advocacy group Access Now, noted that Paragon has a reputation for being a more ethical spyware company. However, she added, “WhatsApp’s recent revelations suggest otherwise.” Krapiva emphasized that the misuse of spyware is not an isolated issue but rather a systemic problem within the commercial spyware industry.