WhatsApp says it disrupted spyware campaign aimed at reporters, civil society | CyberScoop<\/title> <meta name=\"description\" content=\"WhatsApp said Friday that it had disrupted a spyware campaign that targeted 90 people, including journalists and activists.\"> <link rel=\"canonical\" href=\"https:\/\/cyberscoop.com\/whatsapp-says-it-disrupted-spyware-campaign-aimed-at-reporters-civil-society\/\"> <meta property=\"og:locale\" content=\"en_US\"> <meta property=\"og:type\" content=\"article\"> <meta property=\"og:title\" content=\"WhatsApp says it disrupted spyware campaign aimed at reporters, civil society\"> <meta property=\"og:description\" content=\"WhatsApp said Friday that it had disrupted a spyware campaign that targeted 90 people, including journalists and activists.\"> <meta property=\"og:url\" content=\"https:\/\/cyberscoop.com\/whatsapp-says-it-disrupted-spyware-campaign-aimed-at-reporters-civil-society\/\"> <meta property=\"og:site_name\" content=\"CyberScoop\"> <meta property=\"article:published_time\" content=\"2025-01-31T19:45:04+00:00\"> <meta property=\"article:modified_time\" content=\"2025-01-31T19:45:06+00:00\"> <meta property=\"og:image\" content=\"https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/01\/whatsapp-says-it-disrupted-spyware-campaign-aimed-at-reporters-civil-society-2.jpg\"> <meta property=\"og:image:width\" content=\"1920\"> <meta property=\"og:image:height\" content=\"1280\"> <meta property=\"og:image:type\" content=\"image\/jpeg\"> <meta name=\"author\" content=\"Tim Starks\"> <meta name=\"twitter:card\" content=\"summary_large_image\"> <meta name=\"twitter:creator\" content=\"@timstarks\">  <link rel=\"dns-prefetch\" href=\"\/\/securepubads.g.doubleclick.net\">\n<link rel=\"dns-prefetch\" href=\"\/\/use.typekit.net\">\n<link rel=\"alternate\" type=\"application\/rss+xml\" title=\"CyberScoop \u00bb Feed\" href=\"https:\/\/cyberscoop.com\/feed\/\">\n<link rel=\"alternate\" type=\"application\/rss+xml\" title=\"CyberScoop \u00bb Comments Feed\" href=\"https:\/\/cyberscoop.com\/comments\/feed\/\"> <link rel=\"stylesheet\" id=\"all-css-2\" href=\"https:\/\/cyberscoop.com\/wp-includes\/css\/dist\/block-library\/style.min.css?m=1732206022g\" type=\"text\/css\" media=\"all\"> <link rel=\"stylesheet\" id=\"all-css-6\" href=\"https:\/\/cyberscoop.com\/wp-content\/mu-plugins\/search\/elasticpress\/dist\/css\/related-posts-block-styles.min.css?m=1736472017g\" type=\"text\/css\" media=\"all\"> <link rel=\"stylesheet\" id=\"all-css-8\" href=\"https:\/\/cyberscoop.com\/wp-content\/themes\/scoopnewsgroup\/dist\/css\/frontend.css?m=1738186663g\" type=\"text\/css\" media=\"all\">\n<link rel=\"stylesheet\" id=\"typekit-css\" href=\"https:\/\/use.typekit.net\/itk2qbh.css?ver=811a4fffdf449a472805\" media=\"all\"> <link rel=\"https:\/\/api.w.org\/\" href=\"https:\/\/cyberscoop.com\/wp-json\/\"><link rel=\"alternate\" title=\"JSON\" type=\"application\/json\" href=\"https:\/\/cyberscoop.com\/wp-json\/wp\/v2\/posts\/83362\"><link rel=\"EditURI\" type=\"application\/rsd+xml\" title=\"RSD\" href=\"https:\/\/cyberscoop.com\/xmlrpc.php?rsd\">\n<meta name=\"generator\" content=\"WordPress 6.7.1\">\n<link rel=\"shortlink\" href=\"https:\/\/cyberscoop.com\/?p=83362\">\n<link rel=\"alternate\" title=\"oEmbed (JSON)\" type=\"application\/json+oembed\" href=\"https:\/\/cyberscoop.com\/wp-json\/oembed\/1.0\/embed?url=https%3A%2F%2Fcyberscoop.com%2Fwhatsapp-says-it-disrupted-spyware-campaign-aimed-at-reporters-civil-society%2F\">\n<link rel=\"alternate\" title=\"oEmbed (XML)\" type=\"text\/xml+oembed\" href=\"https:\/\/cyberscoop.com\/wp-json\/oembed\/1.0\/embed?url=https%3A%2F%2Fcyberscoop.com%2Fwhatsapp-says-it-disrupted-spyware-campaign-aimed-at-reporters-civil-society%2F&format=xml\">   <link rel=\"icon\" href=\"https:\/\/cyberscoop.com\/wp-content\/uploads\/sites\/3\/2023\/01\/cropped-cs_favicon-2.png?w=32\" sizes=\"32x32\">\n<link rel=\"icon\" href=\"https:\/\/cyberscoop.com\/wp-content\/uploads\/sites\/3\/2023\/01\/cropped-cs_favicon-2.png?w=192\" sizes=\"192x192\">\n<link rel=\"apple-touch-icon\" href=\"https:\/\/cyberscoop.com\/wp-content\/uploads\/sites\/3\/2023\/01\/cropped-cs_favicon-2.png?w=180\">\n<meta name=\"msapplication-TileImage\" content=\"https:\/\/cyberscoop.com\/wp-content\/uploads\/sites\/3\/2023\/01\/cropped-cs_favicon-2.png?w=270\"> <\/head><body class=\"post-template-default single single-post postid-83362 single-format-standard\" id=\"readabilityBody\"> <a href=\"https:\/\/cyberscoop.com\/whatsapp-says-it-disrupted-spyware-campaign-aimed-at-reporters-civil-society\/#main\" class=\"skip-to-content-link visually-hidden-focusable\">Skip to main content<\/a> <\/p>\n<div class=\"ad ad--top ad--top-desktop\">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<p> <main id=\"main\" role=\"main\" tabindex=\"-1\"> <\/p>\n<div class=\"ad ad--top ad--top-mobile\">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<section id=\"stickybar\" class=\"stickybar stickybar--event js-stickybar\">\n<div class=\"stickybar__details\" readability=\"5.12\">\n<div class=\"stickybar__info js-sticky-bar-content\" readability=\"32\">\n<p>Nominations can be submitted for the 2025 CyberScoop 50 awards!<\/p>\n<\/div>\n<p> <a class=\"stickybar__link button button-tertiary\" href=\"https:\/\/cyberscoop.com\/cyberscoop50\/\">Click here!<\/a> <\/div>\n<p> <button class=\"stickybar__close js-stickybar-close\" aria-controls=\"stickybar\"> <svg class=\"icon icon--close\" width=\"21\" height=\"22\" viewBox=\"0 0 21 22\" fill=\"none\"><path d=\"m.822.518-.805.805L9.695 11 .017 20.678l.805.805 9.678-9.678 9.677 9.678.806-.805L11.305 11l9.678-9.677-.806-.805-9.677 9.677L.822.518Z\" fill=\"currentColor\" \/><\/svg> <span class=\"visually-hidden\">Close<\/span> <\/button> <\/section>\n<article class=\"single-article content\">\n<div class=\"single-article__container js-single-article-content\">\n<header class=\"single-article__header \" readability=\"25.749166666667\">\n<div class=\"single-article__header-content\" readability=\"34.368\">\n<p> The company linked to the campaign recently signed a deal with U.S. Immigration and Customs Enforcement. <\/p>\n<p>  <br \/>\n<audio id=\"audio-player\" src=\"https:\/\/wp-tts-cdn.api.scpnewsgrp.com\/cyberscoop\/83362\/english.openai.mp3\"><\/audio> <\/p>\n<div readability=\"11\">\n<div>\n<p>Listen to this article<\/p>\n<p>  <\/p>\n<p>0:00<\/p>\n<\/p><\/div>\n<p>  <\/p>\n<p> <span id=\"tts-tooltip\">Learn more.<\/span> <span> This feature uses an automated voice, which may result in occasional errors in pronunciation, tone, or sentiment. <\/span> <\/p>\n<\/div>\n<p>  <\/div>\n<div class=\"single-article__cover-wrap\">\n<figure class=\"single-article__cover\"> <img data-recalc-dims=\"1\" fetchpriority=\"high\" width=\"640\" height=\"426\" src=\"https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2025\/01\/whatsapp-says-it-disrupted-spyware-campaign-aimed-at-reporters-civil-society.jpg?resize=640%2C426&ssl=1\" class=\"single-article__cover-image wp-post-image\" alt decoding=\"async\" fetchpriority=\"high\" srcset=\"https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/01\/whatsapp-says-it-disrupted-spyware-campaign-aimed-at-reporters-civil-society-2.jpg 1920w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/01\/whatsapp-says-it-disrupted-spyware-campaign-aimed-at-reporters-civil-society-2.jpg?resize=300,200 300w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/01\/whatsapp-says-it-disrupted-spyware-campaign-aimed-at-reporters-civil-society-2.jpg?resize=768,512 768w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/01\/whatsapp-says-it-disrupted-spyware-campaign-aimed-at-reporters-civil-society-2.jpg?resize=1024,683 1024w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/01\/whatsapp-says-it-disrupted-spyware-campaign-aimed-at-reporters-civil-society-2.jpg?resize=1536,1024 1536w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/01\/whatsapp-says-it-disrupted-spyware-campaign-aimed-at-reporters-civil-society-2.jpg?resize=600,400 600w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/01\/whatsapp-says-it-disrupted-spyware-campaign-aimed-at-reporters-civil-society-2.jpg?resize=252,168 252w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/01\/whatsapp-says-it-disrupted-spyware-campaign-aimed-at-reporters-civil-society-2.jpg?resize=506,337 506w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/01\/whatsapp-says-it-disrupted-spyware-campaign-aimed-at-reporters-civil-society-2.jpg?resize=1013,675 1013w, https:\/\/ddi.mohflo.net\/wp-content\/uploads\/2025\/01\/whatsapp-says-it-disrupted-spyware-campaign-aimed-at-reporters-civil-society-2.jpg?resize=1265,843 1265w\" sizes=\"(max-width: 1013px) 100vw, 1013px\"><figcaption> This illustration photograph taken on November 27, 2024, shows the logo of US instant messaging software Whatsapp displayed on a smartphone’s screen, in Frankfurt am Main, western Germany. (Photo by Kirill KUDRYAVTSEV \/ AFP) <\/figcaption><\/figure>\n<\/p><\/div>\n<\/header>\n<div class=\"single-article__content\">\n<div class=\"single-article__content-inner has-drop-cap\"> <html readability=\"18.912903225806\"><body readability=\"39.316425120773\"><\/p>\n<p>WhatsApp said Friday that it had disrupted a spyware campaign that targeted 90 people, including journalists and activists.<\/p>\n<p>The company tied to the campaign, according to WhatsApp, is Israeli firm Paragon, which last fall <a href=\"https:\/\/www.wired.com\/story\/ice-paragon-solutions-contract\/\">signed a $2 million contract<\/a> with Immigration and Customs Enforcement and <a href=\"https:\/\/www.haaretz.com\/israel-news\/security-aviation\/2024-12-16\/ty-article\/.premium\/israeli-spyware-firm-paragon-sold-to-u-s-as-trumps-digital-arsenal-grows\/00000193-cd72-d450-a7b3-cffb9a180000\">recently was purchased<\/a> by U.S. private equity giant AE International.<\/p>\n<p>\u201cWe\u2019ve reached out directly to people who we believe were affected,\u201d said a WhatsApp spokesperson. \u201cThis is the latest example of why spyware companies must be held accountable for their unlawful actions. WhatsApp will continue to protect peoples\u2019 ability to communicate privately.\u201d<\/p>\n<p>WhatsApp has been at the legal forefront of the battle against spyware abuses, most recently <a href=\"https:\/\/cyberscoop.com\/judge-grants-ruling-in-favor-of-whatsapp-against-spyware-firm-nso-group\/\">winning a decision<\/a> against NSO Group. It has sent a cease and desist letter to Paragon. Paragon did not immediately respond to requests for comment.<\/p>\n<div class=\"ad ad--inline_1 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<p>The campaign involved using groups and sending a malicious PDF file, according to WhatsApp, which said it was confident that it had disrupted the infection vector.<\/p>\n<p>WhatsApp swapped information with the University of Toronto\u2019s Citizen Lab on the campaign. It shows that the narrative that the spyware industry just has \u201csome bad apples\u201d isn\u2019t true, said John Scott-Railton, senior researcher at Citizen Lab. \u201cIt is a feature of the commercial spyware marketplace,\u201d he said. \u201cTargeting of journalists and civil society is a matter of when, not if.\u201d<\/p>\n<p>Furthermore, \u201cas ever in a situation like this, if I\u2019m a government I should be very concerned that my own personnel were targeted using this vector,\u201d Scott-Railton said.<\/p>\n<p><\/body> <\/p>\n<footer class=\"single-article__footer\">\n<div class=\"author-card\" readability=\"7.7216117216117\">\n<div class=\"author-card__avatar\">\n<figure class=\"author-card__image-wrap\"> <img data-recalc-dims=\"1\" decoding=\"async\" class=\"author-card__image\" src=\"https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2025\/01\/whatsapp-says-it-disrupted-spyware-campaign-aimed-at-reporters-civil-society-1.jpg?w=640&ssl=1\" alt=\"Tim Starks\"> <\/figure>\n<\/p><\/div>\n<div class=\"author-card__details\" readability=\"10.901098901099\">\n<h4 class=\"author-card__name\">Written by Tim Starks<\/h4>\n<p> Tim Starks is senior reporter at CyberScoop. His previous stops include working at The Washington Post, POLITICO and Congressional Quarterly. An Evansville, Ind. native, he’s covered cybersecurity since 2003. Email Tim here: <a href=\"mailto:tim.starks@cyberscoop.com\">tim.starks@cyberscoop.com<\/a>. <\/div>\n<\/p><\/div>\n<div class=\"single-article__tags-container\">\n<h4 class=\"single-article__tags-title\">In This Story<\/h4>\n<\/p><\/div>\n<\/footer>\n<p> <\/html><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<div class=\"single-article__ads js-single-article-sidebar\">\n<div class=\"ad ad--sidebar js-single-article-sidebar-5 ad--rightrail_1 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<div class=\"ad ad--sidebar js-single-article-sidebar-4 ad--rightrail_2 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<div class=\"ad ad--sidebar js-single-article-sidebar-3 ad--rightrail_3 \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div><\/div>\n<\/article>\n<div class=\"popular-stories popular-stories--single-post\">\n<div class=\"popular-stories__container\">\n<h2 class=\"popular-stories__title\"> More Scoops <\/h2>\n<p>  <\/div>\n<p>\n<\/div>\n<p> <\/p>\n<section class=\"latest-podcasts\">\n<h2 class=\"latest-podcasts__title\"> Latest Podcasts\t<\/h2>\n<\/section>\n<div class=\"top-categories\">\n<div class=\"top-categories__container\">\n<h3 class=\"top-categories__category-title\">Government<\/h3>\n<\/p><\/div>\n<div class=\"top-categories__container\">\n<h3 class=\"top-categories__category-title\">Technology<\/h3>\n<\/p><\/div>\n<\/p><\/div>\n<p> <\/main> <\/p>\n<div class=\"ad ad--bottom \">\n<div class=\"ad__inner\"> <span class=\"screen-reader-text\">Advertisement<\/span> <\/div>\n<\/div>\n<div id=\"interstitial\" class=\"welcome__container\"> <button id=\"close-modal-1\" class=\"welcome__clickable_area\"><\/button> <\/p>\n<div class=\"welcome__ad_wrapper\">\n<p> <button id=\"close-modal-3\" class=\"welcome__continue-button\">Continue to CyberScoop<\/button> <\/p>\n<\/p><\/div>\n<\/p><\/div>\n<p>   <\/body> <a href=\"https:\/\/cyberscoop.com\/whatsapp-says-it-disrupted-spyware-campaign-aimed-at-reporters-civil-society\/\">Source<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>WhatsApp says it disrupted spyware campaign aimed at reporters, civil<\/p>\n","protected":false},"author":11,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[2045,78,3644,1469,3645,268,482,310,288,2345,2294],"tags":[2050,86,3646,1471,3647,274,484,311,294,2348,2303],"class_list":["post-7157","post","type-post","status-publish","format-standard","hentry","category-citizen-lab","category-cybersecurity","category-ice","category-nso-group","category-paragon","category-privacy","category-spyware","category-technology","category-threats","category-u-s-courts","category-whatsapp","tag-citizen-lab","tag-cybersecurity","tag-ice","tag-nso-group","tag-paragon","tag-privacy","tag-spyware","tag-technology","tag-threats","tag-u-s-courts","tag-whatsapp"],"featured_image_urls":{"full":"","thumbnail":"","medium":"","medium_large":"","large":"","1536x1536":"","2048x2048":"","chromenews-featured":"","chromenews-large":"","chromenews-medium":""},"author_info":{"display_name":"Cyber Scoop","author_link":"https:\/\/ddi.mohflo.net\/index.php\/author\/cyberscoop\/"},"category_info":"<a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/citizen-lab\/\" rel=\"category tag\">Citizen Lab<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/cybersecurity\/\" rel=\"category tag\">Cybersecurity<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/ice\/\" rel=\"category tag\">ICE<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/nso-group\/\" rel=\"category tag\">NSO Group<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/paragon\/\" rel=\"category tag\">Paragon<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/privacy\/\" rel=\"category tag\">Privacy<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/spyware\/\" rel=\"category tag\">spyware<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/technology\/\" rel=\"category tag\">Technology<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/threats\/\" rel=\"category tag\">Threats<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/u-s-courts\/\" rel=\"category tag\">U.S. courts<\/a> <a href=\"https:\/\/ddi.mohflo.net\/index.php\/category\/whatsapp\/\" rel=\"category tag\">WhatsApp<\/a>","tag_info":"WhatsApp","comment_count":"0","jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts\/7157","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/users\/11"}],"replies":[{"embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/comments?post=7157"}],"version-history":[{"count":0,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts\/7157\/revisions"}],"wp:attachment":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/media?parent=7157"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/categories?post=7157"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/tags?post=7157"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}

{"id":7157,"date":"2025-01-31T13:45:04","date_gmt":"2025-01-31T19:45:04","guid":{"rendered":"https:\/\/cyberscoop.com\/?p=83362"},"modified":"2025-01-31T13:45:04","modified_gmt":"2025-01-31T19:45:04","slug":"whatsapp-says-it-disrupted-spyware-campaign-aimed-at-reporters-civil-society","status":"publish","type":"post","link":"https:\/\/ddi.mohflo.net\/index.php\/2025\/01\/31\/whatsapp-says-it-disrupted-spyware-campaign-aimed-at-reporters-civil-society\/","title":{"rendered":"WhatsApp says it disrupted spyware campaign aimed at reporters, civil society"},"content":{"rendered":"