WhatsApp confirms Israeli spyware company targeted dozens of its users

The official told the Reuters news agency on Friday that WhatsApp had sent Paragon a cease-and-desist letter following the hack.

The official declined to say who, specifically, was targeted but confirmed that WhatsApp is referring targets to the Canadian internet watchdog group Citizen Lab.

He declined to say how WhatsApp ascertained that Paragon was responsible for the breach. He said law enforcement and industry partners had been informed, but would not go into detail.

In a statement, WhatsApp said the company “will continue to protect people’s ability to communicate privately”.

WhatsApp also told the United Kingdom’s Guardian newspaper that it had “high confidence” the users in question had been targeted and “possibly compromised”.

Paragon declined to comment.

Citizen Lab researcher John Scott-Railton told Reuters that the discovery of Paragon spyware targeting WhatsApp users “is a reminder that mercenary spyware continues to proliferate and as it does, so we continue to see familiar patterns of problematic use”.

Paragon sells high-end surveillance software to government clients. They typically advertise their services as critical to fighting crime and protecting national security.

Similar spy tools – which allow remote access to mobile devices without the victim’s knowledge – have been discovered on the phones of journalists, activists, and at least 50 US officials, raising concerns about the unchecked proliferation of spyware technology.

Several reports in recent years have found that Israeli-made Pegasus spyware has been used by governments across the world to spy on activists, journalists, and even heads of state.

Paragon, which was co-founded by former Israeli Prime Minister Ehud Barak, was reportedly sold to a US private equity firm, AE Industrial Partners, for $900m in 2024.

The company’s website advertises “ethically based tools, teams, and insights to disrupt intractable threats”.

Natalia Krapiva, senior tech-legal counsel at the advocacy group Access Now, said Paragon had the reputation of being a more responsible spyware company, “but WhatsApp’s recent revelations suggest otherwise”.

“This is not just a question of some bad apples — these types of abuses [are] a feature of the commercial spyware industry,” she told Reuters.

Reuters said that AE did not immediately return a message seeking comment.