This is a research prototype. The data and analyses are preliminary and not yet validated — we'd welcome your .
Paragon Solutions' Graphite spyware was used in a zero-click campaign to compromise the devices of nearly 100 journalists and civil society members globally. The exploit involved sending malicious PDF files via WhatsApp group chats, allowing the spyware to bypass security and access encrypted communications. Following the disclosure, Paragon terminated its contract with Italy, and WhatsApp implemented server-side mitigations to block the attack vector.
Researchers at Citizen Lab and Censys reportedly identified spyware infections involving Graphite, a tool attributed to Israeli firm Paragon Solutions. The spyware was allegedly deployed against civil society actors, including journalists and aid workers, through a zero-click WhatsApp exploit. WhatsApp notified over 90 targeted individuals. Evidence reportedly suggests deployments in multiple democratic countries.
Domain classification, causal taxonomy, severity scores, and national security assessments were LLM-classified and may contain errors.
Using AI systems to conduct large-scale disinformation campaigns, malicious surveillance, or targeted and sophisticated automated censorship and propaganda, with the aim of manipulating political processes, public opinion, and behavior.
Also classified as
The spyware compromised the privacy of targeted individuals by covertly accessing and extracting non-public sensitive data from their personal devices.
The incident involves the coordinated use of sophisticated spyware by state actors to conduct malicious surveillance at scale against journalists and human rights defenders.
Human
Due to a decision or action made by humans
Intentional
Due to an expected outcome from pursuing a goal
Post-deployment
Occurring after the AI model has been trained and deployed
The incident was driven by human decisions to deploy surveillance software against civil society targets post-deployment.
Added categories peak at 2: Minor (Psychological Harm, Inferred)
A global surveillance campaign utilized Paragon Solutions' Graphite spyware to target journalists and civil society members via a zero-click WhatsApp exploit. The incident represents a substantial threat to information security and human rights, highlighting the ongoing national security challenges posed by the proliferation of commercial cyber-surveillance tools.
The Graphite spyware operates as a highly specialized tool designed to exploit specific software vulnerabilities and extract data upon direct command, without exhibiting autonomous goal-directed planning or independent decision-making.
High Risk: The system is a surveillance tool deployed by law enforcement and intelligence agencies, which has significant implications for fundamental rights and public interest.
The primary function of the Graphite spyware is to conduct covert surveillance, intercept communications, and track the activities of targeted individuals.
The reports provide consistent, detailed, and cross-verified accounts from highly credible sources like Citizen Lab, Meta, and Amnesty International regarding the spyware's mechanism, targets, and the resulting actions taken by WhatsApp and Paragon.
None. The consensus across all reports is that this was a targeted state-sponsored surveillance campaign using commercial spyware.
Technology
Zero-Click Zero-Day Vulnerability
Exploited auto-parsing in WhatsApp to load spyware without user interaction.
Sandbox Escape Capabilities
Spyware escaped Android sandbox to compromise other applications on devices.
Server-Side Impersonation
Bypassed device security by impersonating users on messaging platform servers.
Data Inputs
Malicious PDF Data Payload
Specially crafted PDF files triggered the zero-day exploit during auto-parsing.
Target Phone Numbers and IDs
Attackers used target phone numbers to add them to malicious group chats.
Human Factors
Unwitting Exposure by Operators
Government employees exposed infrastructure through poor operational security.
Targeting of Civil Society
Clients targeted journalists and activists instead of criminals or terrorists.
Process and Methods
Automatic Parsing of Documents
Messaging apps automatically parsed incoming PDFs, triggering the exploit.
Inadequate Independent Auditing
Invasive spyware products cannot be independently audited for human rights.
Weak Operational Security
Paragon left digital fingerprints like exposing server pages titled 'Paragon'.
Management
Ethical Safeguard Failure
Paragon's claimed safeguards failed to prevent the targeting of civil society.
Prioritization of Profit
Commercial vendors sold invasive tools globally to expand lucrative markets.
Lack of Client Oversight
Management failed to adequately monitor how clients used their software.
Regulatory Environment
Lack of Binding AI Regulations
No binding national or international legislation governs AI and spyware tools.
Laissez-Faire Surveillance Policy
European authorities failed to implement PEGA recommendations on spyware.
Unregulated Dual-Use Exports
Israeli defense export controls failed to prevent sales to abusive clients.
AI system involved
Identified by automated extraction; can differ from the alleged developers above.
