A spokesperson for Meta Platforms’ well-known WhatsApp service disclosed that numerous users, including journalists and civil society members, have been targeted by the Israeli spyware firm Paragon Solutions.
On Friday, the spokesperson announced that WhatsApp had issued a cease-and-desist letter to Paragon in response to the incident. The company emphasized its commitment to safeguarding users’ right to communicate privately.
Paragon has chosen not to provide any comment on the situation.
The WhatsApp representative informed Reuters that an attempt to hack around 90 users had been detected.
While specific details about the individuals targeted were not disclosed, the spokesperson indicated that the victims were spread across over two dozen countries, with several based in Europe. It was reported that WhatsApp users received malicious electronic documents requiring no user interaction to exploit their devices, identifying it as a zero-click hack that is especially difficult to trace.
According to the spokesperson, WhatsApp has since neutralized the hacking efforts and is collaborating with the Canadian internet watchdog Citizen Lab to assist the affected users. Details regarding how WhatsApp connected Paragon to the hack remain undisclosed. However, the spokesperson confirmed that law enforcement and various industry partners have been alerted.
As of now, the FBI has not responded to requests for comment.
John Scott-Railton, a researcher at Citizen Lab, noted that the exposure of Paragon spyware targeting WhatsApp users underscores the growing issue of mercenary spyware in the digital landscape, highlighting persistent patterns of misuse.
Spyware companies like Paragon typically market their sophisticated surveillance technologies to government entities, presenting themselves as crucial players in crime prevention and national security efforts.
However, these surveillance tools have been repeatedly found on the devices of journalists, activists, opposition leaders, and at least 50 U.S. officials, raising significant concerns over the unregulated spread of such technologies.
Recently acquired by AE Industrial Partners, a Florida-based investment group, Paragon has attempted to position itself as a more responsible entity in the industry.
The company’s website promotes “ethically based tools, teams, and insights to disrupt intractable threats,” with sources suggesting that Paragon restricts its sales to governments in stable democracies.
Natalia Krapiva, senior tech-legal counsel at Access Now, remarked that while Paragon has had a reputation as a more reputable spyware company, WhatsApp’s latest findings call this into question.
Krapiva pointed out, “This is not merely a matter of a few bad actors—such abuses are inherent features of the commercial spyware industry.”
AE Industrial Partners did not provide a response when approached for comment.
© Thomson Reuters 2025
