Global Surveillance Scandal: Israeli Spyware Secretly Taps Government Communications
Summary
- Controversy Erupts: Researchers say six governments likely use Israeli spyware to hack messaging apps.
- Spyware Details: The spyware, called Graphite, is made by Israeli firm Paragon Solutions.
- Political Repercussions: Rights groups are calling for transparency and accountability.
- Future Outlook: The case raises new questions about regulating spyware.
Israeli Spyware: An Undercover Operation
In March 2025, researchers at the University of Toronto’s Citizen Lab reported that six governments were likely customers of Graphite, spyware made by the Israeli company Paragon Solutions. The countries named were Australia, Canada, Cyprus and Denmark, along with Israel and Singapore. The report drew wide attention because Paragon had marketed itself as a more responsible alternative to other spyware makers.
A Deep Dive into Spyware Mechanics
Graphite is sold to government agencies. According to Citizen Lab and reporting by The Hacker News, it can be installed without the target doing anything, a so-called zero-click attack. Once on a phone, it can read messages from apps like WhatsApp and Signal.
Earlier in 2025, WhatsApp said it had disrupted a Paragon campaign that targeted about 90 users. Journalists were among them. Several of the people targeted were in Italy.
Start your morning with the signal that matters.
Weekday mornings. Five minutes. What changed in security, why it matters.
By subscribing you agree to our Privacy Policy.
Free. Weekday mornings. 5 minutes or less.
The Global Backlash
The findings drew sharp criticism. Digital rights groups said the case showed that spyware sold for fighting crime keeps ending up aimed at journalists and activists.
Rights advocates want investigations. They also want tighter rules.
Unmasking the Players
Most of the governments named didn’t confirm they used Graphite. Citizen Lab also found evidence linking the Canadian deployment to the Ontario Provincial Police.
Paragon has said it sells only to democratic governments and their agencies for fighting serious crime and terrorism. Critics said the new findings show those limits don’t prevent abuse.
Future Implications for Cybersecurity
The case raises hard questions about how governments use surveillance tools. The line between lawful surveillance and privacy abuse gets blurry fast when the software is this powerful.
Start your morning with the signal that matters.
Weekday mornings. Five minutes. What changed in security, why it matters.
By subscribing you agree to our Privacy Policy.
Free. Weekday mornings. 5 minutes or less.
Researchers and rights groups argue that without clear rules and oversight, spyware will keep spreading to new governments and new targets.
An Ethical Crossroads
The Paragon findings are another moment of reckoning. Surveillance technology is moving fast. The laws that govern it are not. International rules could help make sure these tools are used only for real security needs.
The episode is a reminder of how easily advanced tools get misused. Policymakers and technologists have to find a way to pair innovation with accountability, and so far that balance is missing.
Newer CyberExperts coverage on this topic
This article still works as background. If you want the current picture, start with the freshest related coverage below and today's brief.
Citrix NetScaler CVE-2026-19490: The Auth Bypass That Went From PoC to Probes in a Day
CVE-2026-19490 is a CVSS 9.3 NetScaler Gateway/AAA auth bypass. A public PoC on Sept 2 was followed by live probes within a...
PaperCut NG/MF: The Print Server That Learned Remote Code Execution Again
CVE-2026-81578 and CVE-2026-82078 chain to pre-auth RCE on PaperCut Application Server. Confirm Emergency Patch Release 2, restrict admin exposure, and hunt like...
JFrog Artifactory CVE-2026-82329: Empty Join Key, Full Admin Token, Busy Scanners
CVE-2026-82329 lets attackers forge Artifactory admin tokens via a deterministic empty join key. Mass scanning peaked near 406,000 attempts; patch fixed builds...
Friday’s brief: Apache’s HTTP/2 fix, then Check Point break-ins, a ScreenConnect add-on and a GitHub secret stealer
The fastest way to catch up on what changed after this article was published.
Start your morning with the signal that matters.
Get the biggest cybersecurity developments, why they matter, and where to go deeper on CyberExperts.
By subscribing you agree to our Privacy Policy.
Free. Weekdays. Built for operators.