WhatsApp reports that it has disabled a hacking campaign targeting journalists using the Paragon spyware.

WhatsApp recently announced that it has dismantled a hacking campaign that affected approximately 90 users, including journalists and civil society activists. According to a company spokesperson, this campaign is linked to Paragon, an Israeli spyware manufacturer that was acquired by AE Industrial Partners, a U.S. private equity firm, last December.

WhatsApp spokesperson Zade Alsawah highlighted the importance of holding spyware companies accountable for their illegal actions and reaffirmed WhatsApp's commitment to protecting the private communication of its users. The company explained that the hacking campaign employed malicious PDF files sent through WhatsApp groups to compromise targets and assured that they have already implemented a solution for this issue. Additionally, they mentioned that the hacking did not require any action from the affected users.

John Scott-Railton, a senior researcher at The Citizen Lab, noted that his team has also been monitoring this Paragon campaign and its attack methods. WhatsApp indicated that the hacking campaign may have occurred in December and that they sent a cease-and-desist letter to Paragon. Despite attempts to obtain comments on this situation, neither the CEO of Paragon, Idan Nurick, nor AE Industrial responded to requests for information.

It is important to note that this is the first time Paragon has been publicly linked to a hacking campaign that apparently targeted journalists and members of civil society. Since its establishment in 2019, the company has maintained a low profile, avoiding scandals that have affected other spyware manufacturers like Intellexa and NSO Group, which have faced sanctions from the U.S. government.

The contract Paragon signed with the U.S. Immigration and Customs Enforcement in September of last year was revealed by several sources, indicating that this partnership was achieved after a review process that demonstrated the company's technology included controls to prevent attacking U.S. residents from abroad.

Details about the targets of this spyware campaign remain uncertain, although WhatsApp mentioned that those affected were in more than two dozen countries, including several in Europe. Natalia Krapiva, a technology lawyer at Access Now, a digital rights organization that investigates spyware abuses, praised WhatsApp's actions, suggesting that recent revelations indicate that Paragon may not be as “better” as previously believed regarding its reputation in the spyware industry.

On its official website, Paragon describes itself as a company that “provides our customers with ethically based tools, teams, and information to disrupt inextricable threats.”