An official from Meta Platforms, the parent company of WhatsApp, revealed that the chat service had been targeted by Israeli spyware firm Paragon Solutions, affecting numerous users, including journalists and civil society figures.
On Friday, the official confirmed that WhatsApp had issued a cease-and-desist letter to Paragon following the hacking incident. In its statement, the company emphasized its commitment to safeguarding users’ ability to communicate securely and privately.
Paragon Solutions has chosen not to comment on the allegations.
According to the WhatsApp official, the company identified an attempt to breach the accounts of around 90 users. Specific details regarding the identity of the targeted individuals were not disclosed, but the official indicated that the users were located in over two dozen countries, with several affected individuals based in Europe. The hack involved sending malicious electronic documents that did not require any interaction from the user to compromise their devices, a technique known as a zero-click hack, noted for its stealthiness.
WhatsApp has since taken measures to disrupt the hacking activities and has referred the affected users to Citizen Lab, a Canadian internet advocacy group. The official refrained from detailing how the company linked Paragon to the illicit hacking, stating that law enforcement and industry partners had been notified, though no further specifics were provided.
Requests for comment from the FBI went unanswered at this time.
John Scott-Railton, a researcher at Citizen Lab, highlighted that the targeting of WhatsApp users by Paragon’s spyware underscores the ongoing proliferation of mercenary spyware and the persistent problematic patterns associated with its use.
Companies like Paragon market high-end surveillance solutions to government clients, frequently promoting their services as vital to countering crime and ensuring national security.
However, these surveillance tools have frequently been found on the devices of journalists, activists, opposition figures, and even more than 50 U.S. officials, raising alarms over the unrestricted spread of such technology.
Recently acquired by AE Industrial Partners, a Florida-based investment group, Paragon has attempted to brand itself as a responsible player in the industry.
The company’s website promotes its offerings as “ethically based tools, teams, and insights to combat persistent threats.” Reports from sources familiar with Paragon suggest that the firm restricts its sales to governments in stable democratic nations.
Natalia Krapiva, senior tech-legal counsel at the advocacy organization Access Now, remarked that Paragon was previously viewed as a more reputable spyware provider, but WhatsApp’s latest findings challenge that perception. “This is not merely an issue of a few bad players — such abuses are inherent to the commercial spyware sector,” she stated.
As of now, AE Industrial Partners has not responded to requests for comment.
© Thomson Reuters 2025
