Researchers have uncovered extensive evidence linking Israeli firm Paragon Solutions to a sophisticated spyware operation that exploited a zero-day vulnerability in WhatsApp to target journalists and civil society members. The investigation confirmed the presence of a unique forensic artifact dubbed “BIGPRETZEL” on multiple devices, which WhatsApp confirmed is associated with Paragon infections. The investigation revealed suspected Paragon deployments across multiple countries, including Australia, Canada, Cyprus, Denmark, Israel, and Singapore. This case challenges Paragon’s claims of having developed an abuse-proof business model, demonstrating that commercial spyware, even when sold to democratic governments, remains vulnerable to misuse against legitimate civil society actors. Researchers shared their infrastructure analysis with Meta, which proved “pivotal” to the company’s ongoing Paragon investigation. Established in Israel in 2019, Paragon Solutions was founded by notable figures, including former Israeli Prime Minister Ehud Barak and Ehud Schneorson, former commander of Israel’s Unit 8200 intelligence unit. Forensic analysis revealed an attempt to infect his iPhone with novel spyware in June 2024, which Apple confirmed they patched in iOS 18. The company markets its Graphite spyware as a more targeted tool that accesses messaging applications rather than taking “complete control” of devices like NSO Group’s notorious Pegasus spyware. When received, the victim’s device would automatically process the PDF, exploiting the vulnerability to load the Graphite spyware implant into WhatsApp without any user interaction. A related case involved David Yambio, founder of Refugees in Libya, who received an Apple notification about spyware targeting in November 2024. Following the investigation, WhatsApp notified approximately 90 potential victims and confirmed the attack was mitigated. On January 31, 2025, WhatsApp notified approximately 90 accounts believed to have been targeted by Paragon’s spyware. Multiple WhatsApp notification recipients in Italy consented to forensic analysis of their devices. After initial denials, the Italian government eventually confirmed it was a Paragon customer, though officials denied targeting journalists and activists. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis.
This Cyber News was published on cybersecuritynews.com. Publication date: Thu, 20 Mar 2025 12:00:08 +0000