- summary
- WhatsApp detected a Paragon Graphite campaign that ran through its service, disrupted it and notified around 90 users in more than two dozen countries, including Italian journalists and activists, in January 2025. The notifications started the forensic work that confirmed the Italian cases.
- country
- Italy
- date text
- 01/2025
- civic actions
- Detection and disruption of the exploit; direct notification of targets.
- id
- CR-ITA-002
- incident id
- ITA-001
- notes
- Added Sep 25 2026. Platform leverage: the attack surface is also a detection surface. Response type: RT-PLT; counters TC-21; escalation stage 5; result: Won — Campaign disrupted; targets warned. (01/2025).
- outcome
- Platform disrupted spyware campaign
- responders
- WhatsApp (Meta) security team
- source
- https://citizenlab.ca/research/a-first-look-at-paragons-proliferating-spyware-operations/; https://www.accessnow.org/press-release/paragon-must-answer-for-spyware-use-against-civil-society/
The public research collection