Paragon spyware found on the phones of Euro journos

They’re the first confirmed cases of Paragon spyware on Apple products, according to Citizen Lab.

Researchers revealed Wednesday that they have confirmed Paragon spyware on an Apple product for the first time, on the phones of European journalists, amid an unfolding surveillance scandal in Italy.

University of Toronto’s Citizen Lab published a report on its findings, which confirmed spyware on the phone of an Italian journalist named Ciro Pellegrino, following a prior alert about the phone of Francesco Cancellato, both of whom work for Italian investigative outlet Fanpage. Citizen Lab also confirmed spyware on the phone of another unnamed European journalist.

Paragon, like leading spyware maker NSO Group, is an Israeli company.

“Paragon is a relatively young company that has tried to present itself as clean and undetectable,” said John Scott-Railton, senior researcher at Citizen Lab. “Instead, they’ve repeatedly gotten caught and they’re now mired in exactly the kind of scandal that NSO has faced for years: namely, unexplained abuses with their technology.”

Paragon has not responded to Citizen Lab’s findings. Although Citizen Lab didn’t name the culprit, it did determine that the same Paragon customer targeted the phone of both Pellegrino and the unnamed European journalist. 

A contract between Paragon and the Italian government ended in acrimony this week. 

“These new revelations show us that the spyware scandal is not going away, neither for Italy nor for Paragon,” said Natalia Krapiva, tech-legal counsel for Access Now. “While the Italian government has been denying responsibility for the targeting of Francesco Cancellato with Paragon’s spyware, Citizen Lab’s new investigation shows that this scandal is just not going away. There appears to be a pattern of targeting Italian journalists critical of the government.”

Citizen Lab’s investigation follows notifications from Apple in April and notifications from WhatsApp in January. It also follows wider detection of Paragon’s Graphite spyware in March in a number of countries.

“Whether they expected it or not. Paragon is encountering a reality,” Scott-Railton said. “If you sell mercenary spyware to governments, they are going to use it and potentially abuse it in ways you cannot control. It’s becoming ever clearer that this is a truism about the industry. It’s not a question of one or two bad apple companies.”

Pegasus, NoviSpy variant spyware found on devices of Serbian activists

It’s the first Pegasus infection of 2026 that Citizen Lab is forensically confirming, and the SHARE Foundation said it’s the biggest wave of spyware surveillance in Serbia…

Someone infected a spyware probe overseer with spyware

Russia uses Cellebrite to break into human rights activist’s phone, even after cancellation of contract

Government

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure

• Election official says Tina Peters would be consultant, won’t have access to election systems