A look at Israeli spyware company Paragon, which makes Graphite: suspected deployments in Australia, Canada, Israel, and more, a WhatsApp zero-click, and more
Key Findings — Introducing Paragon Solutions. Paragon Solutions was founded in Israel in 2019 and sells spyware called Graphite.
Context & Ripple Effects
Paragon has been described since 2021 as a vendor positioned to help police access encrypted messaging, while later coverage showed government spyware use continuing even amid constraints placed on other suppliers. This report gives that previously limited profile a broader operational footprint.
The reported WhatsApp capability also follows WhatsApp's disruption of a campaign targeting journalists and civil-society members, making Graphite's exposure relevant not only to government buyers but to the security posture of messaging platforms and their users.
First-order effects
- Suspected Graphite deployments in Australia, Canada, Israel, and elsewhere put Paragon and any government users under sharper scrutiny over authorization, targeting, and oversight.
- A reported WhatsApp zero-click capability raises the risk that targets can be compromised without interacting with a message, limiting the value of user-level precautions against the alleged technique.
Second-order effects
- Messaging platforms and device-security teams face pressure to investigate and patch suspected exploit paths, especially after WhatsApp previously disrupted a Paragon-linked targeting campaign.
- The findings make provenance and customer controls more consequential for spyware vendors seeking legitimacy in a market the US has sought to steer toward allied suppliers, as described in earlier coverage of US influence over the spyware market.
Third-order effects
- If repeated investigations continue to identify deployments across jurisdictions, commercial spyware oversight is likely to shift from judging individual vendors to tracing the full chain of vendor, government purchaser, operator, platform, and target.
- The case reinforces a durable accountability gap: cross-border surveillance tooling can scale faster than the legal and technical mechanisms available to expose misuse.
The trend: Commercial spyware is becoming a cross-border governance problem in which platform security, government procurement, and vendor accountability are increasingly inseparable.