Google's TAG publishes a report on commercial spyware, detailing ~40 vendors, and says global governments should take more aggressive steps to combat spyware
Twitter's natural heir is finally open to the public — and it has some big ideas for social networking Shane Huntley / The Keyword : Buying Spying: How the commercial surveillance industry works and what can be done about it Pierluigi Paganini / Security Affairs : Commercial spyware vendors are behind most zero-day exploits discovered by Google TAG Google : Buying Spying: Insights into Commercial Surveillance Vendors Taylor Swift / Times of India : Google names and shames spyware companies that are ‘dangerous’ for free speech, elections Steve Zurier / SC Media : Spyware behind nearly 50% of zero-days targeting Google products Jessica Lyons / The Register : The spyware business is booming despite government crackdowns Zeljka Zorz / Help Net Security : The fight against commercial spyware misuse is heating up Arielle Waldman / Security : Google: Spyware vendors are driving zero-day exploitation Abdul Raouf Al Sbeei / Supercharged : iPhone zero-days exploited in government-linked hacking campaign CircleID : U.S. Implements New Visa Restrictions to Combat Commercial Spyware Abuse Tara Seals / ITPro Today : World Govs, Tech Giants Sign Spyware Responsibility Pledge Sam Sabin / Axios : Small spyware companies are a big problem KRQE-TV : Google calls on US to do more to rein in spyware sales, misuse Vivek Gurung / Cyber Kendra : Google Exposes Dangerous Commercial Spyware Industry Enabling Government Surveillance Akshaya Asokan / PaymentSecurity.io : US, UK and France Pressure Commercial Spyware Industry Associated Press : US to Impose Visa Limits on Spyware Abusers Targeting Journalists, Activists Akshaya Asokan / InfoRiskToday.com : US, UK and France Pressure Commercial Spyware Industry Jeffrey Burt / Security Boulevard : US Uses Visa Restrictions in Struggle Against Spyware Malay Mail : Google calls out spyware firms and advocates for tighter regulation Damien Black / Cybernews.com : Google: spyware profiteers ruining free speech Emma Woollacott / Forbes : Visa Restrictions On The Way For Commercial Spyware Vendors TechRadar : US will halt visas of anyone involved in spyware Bill Goodwin / ComputerWeekly.com : UK and France push for international agreement on spyware Darryl Coote / UPI : U.S. unveils new visa restrictions for misuse of commercial spyware Antoaneta Roussi / Politico : The UK, US, France, Poland, and other nations, plus Apple, Google, Meta, Microsoft, and others, sign a statement recognizing the need for more action on spyware X: Maddie Stone / @maddiestone : We're naming names 🔥 because the harm is not hypothetical. Today we share “Buying Spying”, our new report diving into the commercial surveillance/spyware industry. We dive into the players, the campaigns, the spyware, & the harm it perpetuates. https://blog.google/... [image] Lorenzo Franceschi-Bicchierai / @lorenzofb : NEW: Google caught government hackers targeting iPhone owners with zero-days and spyware made by Variston, a Barcelona-based startup. According to former Variston staff, the startup has lost multiple employees last year and is struggling. https://techcrunch.com/... John Scott-Railton / @jsrailton : 9/ Invaluable report on commercial spyware from @google. Now, for a wish: Dear, @Android team. Please build lockdown mode for #android. Why? well evidence shows @Apple's #lockdownmode frustrates much commercial spyware. Sadly, Android users don't have anything comparable rn. John Scott-Railton / @jsrailton : WOW: ~ 50% of 0day exploits against Google/Android products now come from commercial vendors. “if governments ever had a monopoly on the most sophisticated capabilities, that era is certainly over” Timely NEW REPORT by @Google TAG Some takeaways🧵 1/ https://blog.google/... [image] John Scott-Railton / @jsrailton : 2/ First, Google's own investigations are surfacing harms associated with mercenary spyware. Key area: it's being being used around elections & key issues. (Side note, I really appreciate that TAG w/ help from @Jigsaw chose to highlight victim stories up front) [image] Shane Huntley / @shanehuntley : But first check out the full 50 page report pulling together years of work by on understanding and countering these threats. https://storage.googleapis.com/ ... Thanks @auroracath @billyleonard @_clem1 @maddiestone @az_matazz @t_gidwani @charley_snyder_ + others for the tireless work. Shane Huntley / @shanehuntley : These commercial surveillance vendors are also behind half of known 0-day exploits targeting Google products as well as Android ecosystem devices. [image] Shane Huntley / @shanehuntley : The proliferation of spyware causes real world harm. We partnered with @Jigsaw to highlight the stories of three high-risk users who attested to the fear felt when these tools were used against them. [image] Shane Huntley / @shanehuntley : Announcing the latest report from Threat Analysis Group documents the rise of commercial surveillance vendors and the industry that threatens free speech, the free press and the open internet https://blog.google/... Some highlights below. 🧵 Forums: Msmash / Slashdot : UK, France Pitch Rules To Curb Spyware Abuse
Context & Ripple Effects
Commercial spyware scrutiny had already moved from isolated disclosures to a recurring platform-security problem: Apple had begun warning people targeted by state-sponsored spyware, while Citizen Lab and Microsoft documented QuaDream attacks against journalists, politicians and civil-society workers.
Google’s report broadens that arc from individual campaigns to the supplier ecosystem, tying vendor activity to a significant share of zero-day exploitation affecting Google products and Android.
First-order effects
- The report puts roughly 40 commercial-surveillance vendors and their role in zero-day exploitation under greater public and policy scrutiny, while strengthening Google’s call for governments to act against sale and misuse.
- Android and Google-product defenders gain a clearer framing for prioritizing threats associated with mercenary spyware vendors; high-risk targets gain further validation that these attacks are an organized commercial risk.
Second-order effects
- Governments that have recognized spyware abuse alongside major technology companies face added pressure to turn that shared position into enforcement, procurement, export-control, or visa-policy measures.
- Spyware vendors and their government customers may face higher operational costs as platform providers, researchers, and policymakers focus on the commercial supply chain rather than only on individual intrusions.
Third-order effects
- If coordinated government and platform action persists, commercial spyware could be treated less as a collection of private security firms and more as a transnational market whose vendors, customers, and exploit supply require accountability.
- The central test will be whether public attribution and targeted restrictions reduce demand and disrupt vendor operations; prior reporting that spyware use continued despite NSO sanctions suggests disclosure alone may not do so.
The trend: Commercial spyware is becoming a supply-chain and governance issue, with platforms and governments increasingly targeting the vendors and state buyers behind zero-day-enabled surveillance.