WhatsApp says there is new Israeli spyware that can target phones, break into private data

WhatsApp has claimed that Israeli spyware firm Paragon Solutions has aimed at almost 100 journalists and civil society individuals in a recent hacking operation, according to a report by The Guardian. WhatsApp reports that the assaults were executed with advanced spyware called Graphite, which can penetrate devices without any involvement from the target — a method referred to as a zero-click attack.

WhatsApp asserts that it is highly confident that approximately 90 individuals, such as journalists and activists, were targeted and may have been compromised. Though the messaging platform did not reveal the locations of those impacted, it confirmed that it had informed them about the potential breach. WhatsApp mentioned that it had issued a cease and desist letter to Paragon and was considering legal avenues to hold the company responsible.

Paragon Solutions, located in Virginia, USA, is recognized for its Graphite spyware, a program similar to the notorious Pegasus software created by NSO Group. After being installed on a device, Graphite provides the operator total access, allowing them to read messages transmitted via encrypted applications such as WhatsApp and Signal.

The attackers’ identity is still unknown. Similar to other spyware companies, Paragon offers its software to government customers, but WhatsApp stated it was unable to identify who commissioned the purported attacks. An individual familiar with Paragon stated that the firm has 35 governmental clients, all of which are democratic countries. The referenced source also mentioned that Paragon refrains from engaging in business with nations that have been previously accused of spyware misuse, including Greece, Poland, Hungary, Mexico, and India.

This event occurs in the context of increasing examination of the commercial spyware sector. Natalia Krapiva, a senior legal counsel for technology at Access Now, pointed out that although Paragon has been regarded as a superior spyware firm with fewer abuse claims, WhatsApp’s disclosures imply a different story. “This isn’t merely an issue of a few bad actors — such abuses are inherent in the commercial spyware sector,” she stated.

WhatsApp’s declaration comes after a recent legal win over NSO Group, another Israeli developer of spyware. In December, a judge in California determined that NSO was responsible for breaching the hacking laws of the US and the terms of service of the platform by hacking 1,400 WhatsApp users in 2019. NSO was placed on a US commerce department blacklist in 2021 for actions considered against US national security interests.