A recent investigation by The Citizen Lab has identified Australia, Canada, Cyprus, Denmark, Israel, and Singapore as probable customers of Graphite spyware, developed by Israeli firm Paragon Solutions. Founded in 2019 by Ehud Barak and Ehud Schneorson, Paragon produces surveillance technology capable of extracting sensitive data from messaging apps.

The findings emerged after researchers mapped server infrastructure linked to the spyware operations. This revelation follows WhatsApp’s December 2024 announcement that it had disrupted Graphite attacks targeting approximately 90 journalists and civil society members across more than 25 countries, primarily in Europe.

“This is the latest example of why spyware companies must be held accountable for their unlawful actions,” a WhatsApp spokesperson stated.

The attack method involved adding targets to WhatsApp groups and sending PDF documents that exploited a zero-day vulnerability to deploy Graphite spyware, which could then escape Android’s sandbox to compromise other applications.

Researchers identified a forensic artifact called BIGPRETZEL that appears to be uniquely associated with Graphite infections. Evidence also suggests Paragon targeted an iPhone belonging to the founder of Refugees in Libya in June 2024.

Apple has since addressed the vulnerability in iOS 18, stating: “Mercenary spyware attacks like this one are extremely sophisticated, cost millions of dollars to develop, often have a short shelf life, and are used to target specific individuals because of who they are or what they do.”