ICE Has a $2M Contract for Spyware That Can Hack Phones Without a Click

ICE has a $2 cardinal statement pinch Paragon, shaper of Graphite, powerful spyware tin of secretly compromising phones without a azygous click.

Graphite is simply a powerful commercialized spyware merchandise tin of entering a smartphone without its proprietor clicking a link, opening an attachment aliases knowingly downloading anything.

Developed by Paragon Solutions, the technology has been connected to surveillance targeting journalists and migration activists successful Europe. U.S. Immigration and Customs Enforcement besides holds a $2 cardinal contract pinch Paragon, raising questions astir really American authorities whitethorn usage the technology.

How Graphite Secretly Compromises Phones

Graphite belongs to the aforesaid class of commercialized surveillance exertion arsenic Pegasus, the better-known spyware developed by NSO Group. Both are classified arsenic mercenary spyware, meaning backstage companies create and waste them to authorities intelligence and rule enforcement agencies.

The 2 products travel from abstracted companies, though some supply authorities customers pinch methods of secretly accessing targeted phones.

Paragon has reportedly designed Graphite chiefly to retrieve accusation from messaging applications alternatively than presume complete power of each telephone function. Once installed, it tin perchance cod accusation from applications specified arsenic WhatsApp and Signal, moreover though those services usage end-to-end encryption.

Encryption protects a connection while it travels betwixt devices. It does not forestall spyware operating wrong 1 of those devices from reference the connection aft the exertion decrypts it. Graphite tin truthful get readable messages without straight breaking WhatsApp aliases Signal’s encryption system.

The astir vulnerable infections require nary correction by the target. A zero-click onslaught useful because phones automatically inspect incoming messages and files earlier displaying them.

An attacker sends specially designed information that takes advantage of a hidden flaw successful that process. When the telephone examines it, the flaw allows the information to tally commands and spot spyware wrong morganatic applications. Graphite tin past nonstop messages and different backstage accusation to the usability without the proprietor seeing aliases opening anything.

Researchers person confirmed Graphite attacks done WhatsApp and iMessage, though the complete method remains secret.

Citizen Lab helped WhatsApp place and artifact an progressive Graphite zero-click utilization successful precocious 2024. WhatsApp warned astir 90 users successful January 2025 that Paragon’s spyware had targeted their accounts. The recipients included journalists and civilian nine figures successful much than 20 countries.

Journalists and Activists Targeted

Researchers examined Android phones belonging to respective group who received the WhatsApp warnings. They recovered grounds indicating that Graphite had loaded spyware components into WhatsApp and different applications connected the devices of Italian migration activists Luca Casarini and Giuseppe Caccia. Italian journalist Francesco Cancellato besides received a informing from WhatsApp.

Italian prosecutors later provided independent confirmation of those infections. In March 2026, prosecutors successful Rome and Naples announced that a method study recovered spyware traces connected the phones of Cancellato, Casarini and Caccia, each making love to the early hours of Dec. 14, 2024.

Investigators recovered operations against Casarini and Caccia connected the Paragon server utilized by Italy’s home intelligence agency, but nary corresponding grounds for Cancellato, leaving whoever infected the journalist’s telephone unidentified.

Another investigation provided the first forensic confirmation that Graphite could target Apple devices. Researchers recovered that the spyware had successfully compromised an unnamed European journalist’s iPhone successful January and February 2025. They besides wished that an usability targeted Italian journalist Ciro Pellegrino utilizing the aforesaid iMessage relationship associated pinch the first case.

The infection exploited a antecedently chartless iMessage vulnerability and would not person been visible to the target. Apple fixed the vulnerability successful iOS 18.3.1.

Italy’s parliamentary intelligence committee later confirmed that Italian agencies utilized Graphite to show Casarini, Caccia and different migration activists. The committee described that surveillance arsenic legally authorized and related to migration and nationalist information matters. It concluded that Italian intelligence agencies had not utilized Graphite against Cancellato.

Paragon and Italian officials offered conflicting accounts of the resulting dispute. The institution said it terminated its Italian contracts aft authorities declined an connection to analyse whether Graphite had been utilized illegally against Cancellato. Italian officials said the termination was communal and allowing a overseas backstage institution to inspect intelligence records would person exposed classified information.

A Spyware Dashboard Appears connected LinkedIn

Graphite besides attracted attraction successful February 2026 aft a Paragon wide counsel posted a photograph connected LinkedIn pinch the spyware’s power sheet visible connected a ample surface successful the background. The station was quickly deleted, but cybersecurity researchers preserved the image.

The dashboard displayed a Czech telephone number identified arsenic “Valentina,” interception records dated Feb. 10 and categories for applications, accounts and media. Researchers identified icons aliases interfaces apparently associated pinch WhatsApp, Signal, Telegram and LINE. The surface besides appeared to show the interception’s position and a warrant expiration field.

Paragon’s Claims of Responsible Surveillance

Paragon was established successful Israel successful 2019 pinch backing from erstwhile Israeli Prime Minister Ehud Barak. Its founders besides included Ehud Schneorson, a erstwhile commandant of Israel’s Unit 8200 subject intelligence division. In December 2024, Florida-based backstage equity patient AE Industrial Partners reportedly agreed to get Paragon for astatine slightest $500 million.

Corporate records later examined by Citizen Lab showed that Paragon’s shares transferred to a U.S. genitor institution connected Dec. 13, 2024. Coincidentally, forensic grounds dates the infections of the Italian journalist and activists to the early hours of Dec. 14, 1 time aft the stock transfer.

Paragon has promoted itself arsenic a much responsible surveillance vendor than companies antecedently connected to spyware abuses. It says it sells its exertion only to vetted authorities agencies successful antiauthoritarian countries and prohibits customers from unlawfully targeting journalists aliases civilian nine figures.

The Italian cases exposed the limits of relying connected contractual restrictions. A spyware institution whitethorn frighten to disconnect a customer, but the nationalist usually cannot spot the warrants, target lists, audit records aliases grounds utilized to warrant individual surveillance operations.

Victims whitethorn not cognize that anyone accessed their phones unless a exertion institution detects the onslaught aliases researchers find surviving forensic evidence.

Former Israeli Prime Minister Ehud Barak helped recovered Paragon Solutions, the institution down Graphite spyware. (Credit/Al Jazeera).Credit: Al Jazeera

ICE’s $2 Million Paragon Contract

ICE signed a $2 cardinal statement pinch Paragon successful September 2024. The nationalist statement summary did not place Graphite by sanction aliases disclose the surveillance capabilities ICE planned to obtain. Officials initially imposed a stop-work bid while the authorities reviewed whether the statement complied pinch a 2023 executive order restricting the usage of commercialized spyware associated pinch information aliases quality authorities risks.

The authorities lifted the stop-work bid successful August 2025, allowing the ICE statement to proceed. Neither ICE nor Paragon publically explained what safeguards would govern its use, who could go a target aliases whether the agency would usage the exertion wrong the United States.

Graphite tin springiness investigators entree to communications they could not get done accepted searches. It tin besides spot a journalist, activistic aliases governmental force nether surveillance without leaving immoderate evident warning. Once governments get that capability, promises from the shaper connection small protection.