Paragon Graphite: spyware against journalists¶

In 2025 the mercenary spyware Graphite, made by the firm Paragon Solutions and sold to government clients, was forensically confirmed on the phones of European journalists. It is the clearest recent evidence that the targeted end of state surveillance, selective targeting, reaches working reporters inside the EU.

What was found¶

On 12 June 2025 the Citizen Lab published the first forensic confirmation of Graphite on iPhones. Its analysts, Bill Marczak and John Scott-Railton, tied two devices to the spyware with high confidence: a prominent European journalist who asked not to be named, compromised in January and early February 2025, and Ciro Pellegrino of Fanpage.it, notified by Apple on 29 April 2025. Both were hit by a zero-click attack over iMessage, one that needed no tap from the person holding the phone; Apple assigned it CVE-2025-43200 and closed it in iOS 18.3.1.

The Italian thread ran wider. WhatsApp had earlier notified around ninety users of a separate Graphite vector, among them the Fanpage.it editor Francesco Cancellato and the migrant-rescue figures Luca Casarini and Giuseppe Caccia. Italy’s parliamentary intelligence committee, COPASIR, later acknowledged that the state had used the tool against Casarini and Caccia, while saying it could not establish who had targeted Cancellato.

The limit of individual defence¶

Graphite is not an exotic capability held by one rogue service. It is a product, licensed to governments, part of a mercenary-spyware market that the European Parliament’s own PEGA inquiry examined after the Pegasus and Predator/Intellexa scandals across Poland, Hungary, Greece and Spain. Paragon is the newest name on a list of adversaries that is an industry.

The case also marks the limit of individual defence. A zero-click iMessage exploit defeats the ordinary advice, because there is nothing to decline to click. What contained it was not an action by the target but a platform patch and a notification from Apple and WhatsApp, which is to say that the parties best placed to detect this class of attack are the platforms. That asymmetry bears hardest on civil society.

Last reviewed: 2026-07-09.