"Paragon spyware activity found on more journalists’ devices", 12 June 2025

Two more European journalists’ mobile devices are confirmed to have been targeted — one successfully — with Paragon spyware, the latest development in a broadening scandal involving the use of the company’s powerful surveillance technology to snoop on members of civil society on the continent.

Digital forensics research institute the Citizen Lab reported... that the journalists were part of a larger group notified in late April by Apple about possible “mercenary spyware” attacks. The researchers document what is believed to be the first known infection of an Apple device with Graphite, a Paragon product.

The latest targets are a “prominent” European journalist who wishes to stay anonymous and Ciro Pellegrino, a colleague of a previously identified Paragon spyware target, Francesco Cancellato, the Citizen Lab said. 

Both Pellegrino and Cancellato work at the Italian news outlet Fanpage, which published an investigation documenting ties between Italy’s Prime Minister Giorgia Meloni and young fascists last June.

A spokesperson for Israel-based Paragon responded to a request for comment by pointing to a previous statement revealing that it has ended its contract with Italy. Citizen Lab says it made Paragon aware of its findings... 

Spokespersons for the Italian Parliament and the prime minister’s office did not respond to requests for comment.

Graphite games

The latest news comes after Paragon publicly cut ties with the Italian government on Monday, four days after a Parliament committee investigating the government’s alleged use of the company’s spyware said it could find no evidence that Cancellato’s phone was targeted. 

The investigating committee and the Italian government at large refused to let Paragon verify the committee’s claims, Haaretz reported Monday. A Paragon spokesperson subsequently confirmed that reporting.

The committee’s report omitted the fact that Paragon had asked to do its own investigation to determine if its product had been used to attack Cancellato’s device.

The Italian government has steadfastly denied using spyware to target Cancellato.

...

‘Something bigger than me’

Pellegrino is less afraid now than he was when he first received the notification, he told Recorded Future News by text on Thursday. He said that is because he has realized that “this is something much bigger than me and that it will probably concern other Italian journalists too.” 

He said he believes Fanpage as a whole has been specifically targeted.

“I don’t like conspiracies, but there are two Italian journalists from the same newspaper in the same condition,” he said. “It can’t be a coincidence."

Pellgrino said he doesn’t know if the Italian government is behind the attacks.

However, he said, he knows that “up to now the Italian government has done NOTHING to help us discover the truth.” 

The Italian Parliament’s investigation report, released June 5 by Italy’s Parliamentary Committee for the Security of the Republic (COPASIR), acknowledged that the country’s  intelligence agencies deployed Graphite on phones belonging to pro-immigration activists, claiming spying on them was lawful due to their role in fueling illegal immigration.

The government’s refusal to let Paragon verify it did not target Cancellato’s device led to the unprecedented public disclosure from a spyware company that it had decided to terminate its work with a customer.

From there the public spat between the spyware firm and its former client accelerated as Italy’s ANSA news service quoted unnamed sources saying the government’s breakup with Paragon was mutual. 

Several Italian news outlets also reported... that the Italian government’s Department of Information for Security (DIS), which manages Italy’s intelligence agencies, said it turned down Paragon’s offer to check Graphite system logs because they are “invasive practices, unverifiable in scope, results and method and, therefore, not compliant with national security requirements.”

Parliament then offered to release Paragon’s committee testimony, according to Citizen Lab, which cited Italian news reports.

...