Saturday, June 14, 2025
HomeCyber Security NewsParagon Spyware Allegedly Ends Spyware Contract with Italy

Paragon Spyware Allegedly Ends Spyware Contract with Italy

Published on

SIEM as a Service

Follow Us on Google News

Paragon Solutions, an Israeli cybersecurity firm, has reportedly ended its spyware contract with Italy.

The termination comes in the wake of revelations that its military-grade hacking software, Graphite, was allegedly used to target 90 individuals, including journalists and activists, across two dozen countries. This includes three Italian figures critical of the government’s policies.

The spyware scandal erupted after WhatsApp disclosed last week that Paragon’s Graphite technology had been used to hack into mobile phones without users’ knowledge.

- Advertisement - Google News

The victims were reportedly added to WhatsApp group chats and sent malicious PDFs, which infected their devices.

Paragon Spyware Ends Contract

WhatsApp’s investigation, supported by Citizen Lab at the University of Toronto, uncovered the breaches in December, though the duration of surveillance remains unclear, as per a report by Guardian.

Among the Italian targets was Francesco Cancellato, the editor-in-chief of investigative outlet Fanpage.

Cancellato had previously exposed young fascists within Italian Prime Minister Giorgia Meloni’s party. Two other targets, Husam El Gomati, a Libyan activist, and Luca Casarini, an NGO founder, have been outspoken opponents of Italy’s alleged complicity in human rights abuses in Libya.

Prime Minister Meloni’s office has denied any involvement by domestic intelligence services or the government in the breaches. Despite this, Meloni is expected to face scrutiny in parliament over the alleged misuse of spyware.

A source close to Paragon, speaking anonymously, revealed that the company initially suspended its Italian contract as a precautionary measure after learning of potential abuses last Friday.

On Wednesday, the company formally terminated its agreement, citing violations of its ethical framework and terms of service. Paragon has declined to comment publicly on the matter.

The targeting of individuals critical of Meloni’s right-wing administration has heightened concerns about spyware being used as a tool for political repression.

 The Italian government, informed by WhatsApp, confirmed that the number of affected Italians is believed to be seven.

The identities of other victims remain undisclosed, though they reportedly span several European countries, including Germany, Spain, and Sweden.

Paragon’s move to end its Italian contract comes amid broader scrutiny. The company, which was recently acquired by U.S.-based AE Industrial Partners, is also under investigation for a $2 million contract with the U.S. Immigration and Customs Enforcement agency.

The outcome of these inquiries, along with Italy’s role in the breaches, remains uncertain. This controversy underscores the growing global concerns over the unchecked use of spyware and its implications for privacy and democratic freedoms.

Investigate Real-World Malicious Links & Phishing Attacks With Threat Intelligence Lookup - Try for Free

Divya
Divya
Divya is a Senior Journalist at GBhackers covering Cyber Attacks, Threats, Breaches, Vulnerabilities and other happenings in the cyber world.

Latest articles

Kali Linux 2025.2 Released: New Tools, Smartwatch and Car Hacking Added

Kali Linux, the preferred distribution for security professionals, has launched its second major release...

Arsen Launches AI-Powered Vishing Simulation to Help Organizations Combat Voice Phishing at Scale

Arsen, the cybersecurity startup known for defending organizations against social engineering threats, has announced...

NIST Releases New Guide – 19 Strategies for Building Zero Trust Architectures

The National Institute of Standards and Technology (NIST) has released groundbreaking guidance to help...

Spring Framework Flaw Enables Remote File Disclosure via “Content‑Disposition” Header

A medium-severity reflected file download (RFD) vulnerability (CVE-2025-41234) in VMware's Spring Framework has been...

Credential Abuse: 15-Min Attack Simulation

Credential Abuse Unmasked

Credential abuse is #1 attack vector in web and API breaches today (Verizon DBIR 2025). Join our live, 15-min attack simulation with Karthik Krishnamoorthy (CTO - Indusface) and Phani Deepak Akella (VP of Marketing - Indusface) to see hackers move from first probe to full account takeover.

Discussion points


Username & email enumeration – how a stray status-code reveals valid accounts.
Password spraying – low-and-slow guesses that evade basic lockouts.
Credential stuffing – lightning-fast reuse of breach combos at scale.
MFA / session-token bypass – sliding past second factors with stolen cookies.

More like this

Kali Linux 2025.2 Released: New Tools, Smartwatch and Car Hacking Added

Kali Linux, the preferred distribution for security professionals, has launched its second major release...

NIST Releases New Guide – 19 Strategies for Building Zero Trust Architectures

The National Institute of Standards and Technology (NIST) has released groundbreaking guidance to help...

Spring Framework Flaw Enables Remote File Disclosure via “Content‑Disposition” Header

A medium-severity reflected file download (RFD) vulnerability (CVE-2025-41234) in VMware's Spring Framework has been...