Paragon spyware attack targeted journalists & civil society, says WhatsApp

WhatsApp uncovered a hacking campaign using Paragon spyware, targeting journalists and civil society members. The attack aimed to breach devices through malicious files shared on the platform

Meta Platforms Inc’s WhatsApp has revealed that it recently disrupted a hacking campaign linked to Israeli spyware company Paragon.  

 

According to a company spokesperson, WhatsApp has detected attempts to compromise around 90 individuals, including journalists and civil society members, in a series of cyberattacks that took place late last year. The attackers reportedly lured targets into a WhatsApp group and then sent them a malicious PDF file designed to infiltrate their devices. It remains unclear where the targeted individuals were located or whether the hacking attempts succeeded. WhatsApp has since notified all affected users.

 

Spyware, which enables unauthorised access to mobile devices and interception of encrypted messages without the user’s knowledge, has been widely criticised for its role in surveillance. Governments have frequently used such tools to monitor journalists, human rights advocates, and political dissidents. The Israeli firm NSO Group, known for its Pegasus spyware, has been under US sanctions since 2021 due to its hacking operations.  

 

Paragon’s technology is designed to covertly access mobile phones, allowing law enforcement and intelligence agencies to monitor encrypted communications on platforms like WhatsApp and Signal. In December, the company was acquired by US private equity firm AE Industrial Partners in a deal valued at up to $900 million.  

 

Paragon has previously asserted that its spyware is sold exclusively to democratic governments and is intended for use against serious criminals.  

 

WhatsApp has a history of legal action against spyware companies. The messaging platform previously sued NSO Group, accusing it of hacking over 1,400 users. In December, a US federal judge in California ruled in WhatsApp’s favour, holding NSO accountable for hacking and breaching contractual agreements.  

 

News agency Reuters quoted Citizen Lab researcher John Scott-Railton as saying that the discovery of Paragon spyware targeting WhatsApp users “is a reminder that mercenary spyware continues to proliferate and as it does, so we continue to see familiar patterns of problematic use”.

 

[With agency inputs]