Two journalists, including an Italian news editor, were targeted with Graphite, a sophisticated spyware developed by Israeli company Paragon Solutions, according to a forensic investigation by Canada-based research organisation Citizen Lab.

To advertise here,

The investigation found evidence that the iPhones of an unnamed prominent European journalist and Ciro Pellegrino, head of the Naples newsroom at Italian news outlet Fanpage.it, were targeted using Paragon's Graphite spyware in early 2025.

Both journalists received threat notifications from Apple on April 29, 2025, warning that they had been targeted by advanced spyware. They subsequently sought technical assistance from Citizen Lab, which examined their devices.

According to the report, the unnamed European journalist's device was infected with Graphite in January and early February 2025 while running iOS 18.2.1.

Investigators found that the device had communicated with a server linked to Paragon's spyware during the period of infection. They also identified an iMessage account, which they believe was used to deploy the spyware through a sophisticated zero-click attack.

A zero-click attack allows hackers to compromise a device without requiring the user to click on a malicious link, download a file or take any action.

In the case of Italian journalist Ciro Pellegrino, investigators found evidence linking his iPhone to the same iMessage account identified in the first case. This suggested that both journalists had been targeted by the same Paragon customer or operator.

Citizen Lab said it attributed both cases to Paragon's Graphite spyware with high confidence. However, the investigation did not establish who was behind the attacks or under what legal authority the surveillance was carried out.

Apple fixed vulnerability used in attacks

Apple confirmed to Citizen Lab that the zero-click vulnerability exploited in the attacks had been addressed in iOS 18.3.1. The company assigned the vulnerability the identifier CVE-2025-43200.

The findings also raised concerns about the targeting of journalists at Fanpage.it. The news outlet's editor, Francesco Cancellato, had received a WhatsApp notification in January 2025 warning that he was targeted with Paragon's Graphite spyware.

However, Citizen Lab said it had not yet found forensic evidence confirming an infection of Cancellato's Android device. The organisation cautioned that the absence of such evidence does not necessarily mean the device was not compromised, as Android devices may not retain all relevant activity logs.

Italy's spyware controversy

The findings emerged amid a wider controversy over the use of Paragon's spyware in Italy.

In a report published on June 5, 2025, Italy's parliamentary committee overseeing intelligence services, COPASIR, acknowledged that the government had used Graphite against activist Luca Casarini and Dr Giuseppe Caccia.

Citizen Lab had previously found forensic evidence of Graphite on their devices.

However, the committee said it could not establish who was responsible for targeting Cancellato.

Citizen Lab noted that three European journalists had been confirmed as targets of Paragon's spyware at the time of its report, although the identity of those responsible for the surveillance remained unclear.

The organisation warned that the cases highlighted the growing risks spyware poses to journalists and the lack of accountability surrounding the use of commercial surveillance technology.

What should users do if they receive a spyware warning?

Citizen Lab has advised journalists, human rights defenders and other members of civil society to take spyware warnings from Apple, Meta, WhatsApp, Google and other technology companies seriously.

It recommended seeking assistance from digital security organisations such as Access Now and Amnesty International's Security Lab to assess possible attacks and improve device security.