Security Affairs

MARCH 19, 2025

WhatsApp fixed a zero-click, zero-day vulnerability used to install Paragon’s Graphite spyware on the devices of targeted individuals. WhatsApp has addressed a zero-click, zero-day vulnerability exploited to install Paragon’s Graphite spyware on the devices of targeted individuals.

Spyware

Malwarebytes

MAY 8, 2025

Meta has won almost $170m in damages from Israel-based NSO Group, maker of the Pegasus spyware. According to the original complaint against NSO Group, filed in October 2019, the spyware vendor used WhatsApp servers to send malware to around 1400 mobile phones. NSO Group is no stranger to controversy. Facebook has its own initiative.

Spyware

Malwarebytes

MARCH 20, 2025

Experts are again warning about the proliferating market for targeted spyware and espionage. Before we dive into the world of targeted spyware, it’s worth looking at a few of the main players that are active in and against this industry. The name of Paragons spyware is Graphite.

Spyware

Security Affairs

MARCH 13, 2025

North Korea-linked APT group ScarCruft used a new Android spyware dubbed KoSpy to target Korean and English-speaking users. Cyber attacks conducted by the APT37 group mainly targeted government, defense, military,and media organizations in South Korea. Kaspersky first documented the operations of the group in 2016.

Spyware

Security Affairs

JUNE 24, 2025

House has banned WhatsApp on government devices due to data security concerns. In March 2025, WhatsApp addressed a zero-click, zero-day vulnerability exploited to install Paragon’s Graphite spyware on the devices of targeted individuals. Similar restrictions apply to AI tools like ChatGPT , ByteDance apps, and Microsoft Copilot.

Government

Security Affairs

APRIL 8, 2025

In March 2025, WhatsApp addressed a zero-click, zero-day vulnerability exploited to install Paragons Graphite spyware on the devices of targeted individuals. WhatsApp blocked a spyware campaign by Paragon targeting journalists and civil society members after reports of the Citizen Lab group from the University of Toronto.

Spyware

Malwarebytes

APRIL 11, 2025

The US State Department reportedly plans to sign an international agreement designed to govern the use of commercial spyware known as the Pall Mall Pact. The goal of the Pall Mall Pact is to regulate Commercial Cyber Intrusion Capabilities (CCICs), or what we usually refer to as spyware and surveillance tools.

Spyware

Security Boulevard

APRIL 8, 2025

Twenty-one countries signed onto the Pall Mall Process, an effort a year in the making that was created to develop a framework nations could adopt to address the proliferation and malicious use of spyware by governments that want it to track human rights workers, activists, journalists, and other such targets.

Spyware

Security Affairs

JUNE 12, 2025

Security researchers at Citizen Lab revealed that Paragon’s Graphite spyware can hack fully updated iPhones via zero-click attacks. Citizen Lab has confirmed that Paragon’s Graphite spyware was used to hack fully updated iPhones, targeting at least two journalists in Europe. Both cases were linked to the same attacker.

Spyware

Security Affairs

DECEMBER 8, 2024

warn of PRC-linked cyber espionage targeting telecom networks U.S. Hackers stole millions of dollars from Uganda Central Bank International Press Newsletter Cybercrime INTERPOL financial crime operation makes record 5,500 arrests, seizures worth over USD 400 million Hackers Stole $1.49

Artificial Intelligence

Malwarebytes

FEBRUARY 3, 2025

WhatsApp has accused the professional spyware company Paragon of spying on a select group of users. WhatsApp, the Meta-owned, end-to-end encrypted messaging platform, said it has reliable information that nearly 100 journalists and other members of civil society were targets of a spyware campaign conducted by the Israeli spyware company.

Spyware

Malwarebytes

MAY 1, 2025

Government-backed groups and customers of commercial surveillance vendors (that’s sanitized corporate-speak for spyware) were responsible for over half the attacks that the researchers were able to attribute. Spyware continues to be a much bigger factor in zero-day exploits today than it was before 2023.

Spyware

Security Affairs

NOVEMBER 16, 2024

” NSO Group continued using WhatsApp exploits, including spyware called “Erised,” even after being sued for violating anti-hacking laws. In May 2019, Facebook patched a critical zero-day vulnerability in WhatsApp, tracked as CVE-2019-3568 , that has been exploited to remotely install spyware on phones by calling the targeted device.

Spyware

Security Affairs

MARCH 3, 2025

The forensics analysis conducted by Amnesty found that the Serbian police used the Cellbrite’s exploit to unlock Vedran’s Samsung Galaxy A32 and install an unknown Android application likely linked with NoviSpy spyware. said Donncha Cearbhaill, Head of the Security Lab at Amnesty International. added Donncha Cearbhaill.

Hacking

Security Affairs

APRIL 13, 2025

Security Affairs Malware newsletter includes a collection of the best articles and research on malware in the international landscape Lazarus Expands Malicious npm Campaign: 11 New Packages Add Malware Loaders and Bitbucket Payloads BadBazaar: iOS and Android Surveillanceware by Chinas APT15 Used to Target Tibetans and Uyghurs GOFFEE continues to attack (..)

Malware

Security Affairs

JUNE 17, 2025

TP-Link Multiple Routers Command Injection Vulnerability Last week, Apple confirmed that the now-patched vulnerability CVE-2025-43200 in its Messages app was actively exploited in the wild to target journalists with Paragon’s Graphite spyware. The group found forensic evidence showing the phones had communicated with the same spyware server.

Spyware

SecureList

NOVEMBER 28, 2024

The secure USB drive was developed by a government entity in Southeast Asia to securely store and transfer files between machines in sensitive environments. Chinese-speaking activity In July 2021, we detected a campaign called ExCone targeting government entities in Russia.

Malware

Security Affairs

JULY 13, 2025

Security Affairs Malware newsletter includes a collection of the best articles and research on malware in the international landscape Datacarry Ransomware DRAT V2: Updated DRAT Emerges in TAG-140’s Arsenal Batavia spyware steals data from Russian organizations Taking SHELLTER: a commercial evasion framework abused in- the- wild Open Source Malware (..)

Malware

Security Affairs

JUNE 15, 2025

Palo Alto Networks fixed multiple privilege escalation flaws Unusual toolset used in recent Fog Ransomware attack A cyberattack on United Natural Foods caused bread shortages and bare shelves Apple confirmed that Messages app flaw was actively exploited in the wild Trend Micro fixes critical bugs in Apex Central and TMEE PolicyServer Paragon Graphite (..)

Spyware

Security Affairs

JUNE 13, 2025

Apple confirmed that a security flaw in its Messages app was actively exploited in the wild to target journalists with Paragon’s Graphite spyware. This week, Citizen Lab confirmed that Paragon’s Graphite spyware was used to hack fully updated iPhones, targeting at least two journalists in Europe.

Spyware

Security Affairs

JUNE 29, 2025

Security Affairs Malware newsletter includes a collection of the best articles and research on malware in the international landscape Ransomware Gangs Collapse as Qilin Seizes Control Dissecting a Python Ransomware distributed through GitHub repositories SparkKitty, SparkCat’s little brother: A new Trojan spy found in the App Store and Google Play (..)

Malware

Security Affairs

FEBRUARY 9, 2025

What are the risks?

Spyware

Security Affairs

NOVEMBER 17, 2024

CISA adds Palo Alto Networks Expedition bugs to its Known Exploited Vulnerabilities catalog Hackers target critical flaw CVE-2024-10914 in EOL D-Link NAS Devices China-linked threat actors compromised multiple telecos and spied on a limited number of U.S.

Cryptocurrency

Security Affairs

JULY 13, 2025

CISA adds MRLG, PHPMailer, Rails Ruby on Rails, and Synacor Zimbra Collaboration Suite flaws to its Known Exploited Vulnerabilities catalog IT Worker arrested for selling access in $100M PIX cyber heist New Batavia spyware targets Russian industrial enterprises Taiwan flags security risks in popular Chinese apps after official probe U.S.

Data breaches

Security Affairs

JANUARY 19, 2025

CISA adds BeyondTrust PRA and RS and Qlik Sense flaws to its Known Exploited Vulnerabilities catalog Inexperienced actors developed the FunkSec ransomware using AI tools Credit Card Skimmer campaign targets WordPress via database injection Microsoft took legal action against crooks who developed a tool to abuse its AI-based services Pro-Russia hackers (..)

Spyware

Security Affairs

JUNE 29, 2025

House banned WhatsApp on government devices due to security concerns Russia-linked APT28 use Signal chats to target Ukraine official with malware China-linked APT Salt Typhoon targets Canadian Telecom companies U.S.

Data breaches

Security Affairs

AUGUST 9, 2025

in crypto since April 2024 Germany limits police spyware use to serious crimes Phishing attacks exploit WinRAR flaw CVE-2025-8088 to install RomCom French firm Bouygues Telecom suffered a data breach impacting 6.4M Enjoy a new round of the weekly SecurityAffairs newsletter, including the international press. Embargo Ransomware nets $34.2M

Data breaches

Security Affairs

JUNE 22, 2025

CISA adds Apple products, and TP-Link routers flaws to its Known Exploited Vulnerabilities catalog Attackers target Zyxel RCE vulnerability CVE-2023-28771 India-based car-sharing company Zoomcar suffered a data breach impacting 8.4M

Data breaches

SecureList

DECEMBER 9, 2024

This information was disseminated, making the vulnerable systems high-visibility targets for threat actors, especially as Fortinet products are commonly found in government, healthcare, and other critical sectors. Researchers said over 87,000 Fortinet IPs were likely affected by one of the identified vulnerabilities at the time.

Internet

Security Boulevard

MARCH 24, 2025

Researchers name several countries as potential Paragon spyware customers TechCrunch The Citizen Lab, a group of academics and security researchers, recently published a report indicating the governments of Australia, Canada, Cyprus, Denmark, Israel, and Singapore are "likely" customers of Israeli spyware maker Paragon Solutions.

Surveillance

Security Affairs

MARCH 8, 2025

Quantum computers threaten to break online security in minutes, expert warns ENISA NIS360 2024 Catalan court says NSO Group executives can be charged in spyware investigation Follow me on Twitter: @securityaffairs and Facebook and Mastodon Pierluigi Paganini ( SecurityAffairs hacking,newsletter)

Data breaches

Schneier on Security

MARCH 31, 2025

Since at least 2014, a US government interagency "equities" process has been used to decide whether it is in the national interest to take advantage of a particular security flaw, or to fix it. Smaller governments that can’t afford their own military-grade encryption use it. The trade-offs are often complicated and hard.

Government

Security Boulevard

MARCH 17, 2025

The 200+ Sites an ICE Surveillance Contractor is Monitoring 404media A contractor for ICE (and other US government agencies) has built a tool that facilitates pulling a target's publicly available data from various sources - which include social media networks, apps, and services.

Surveillance

Security Affairs

APRIL 20, 2025

infrastructure International Press Newsletter Cybercrime Pixel-Perfect Trap: The Surge of SVG-Borne Phishing Attacks Threat actors misuse Node.js infrastructure International Press Newsletter Cybercrime Pixel-Perfect Trap: The Surge of SVG-Borne Phishing Attacks Threat actors misuse Node.js

Data breaches

Security Affairs

NOVEMBER 24, 2024

CISA adds Apple, Oracle Agile PLM bugs to its Known Exploited Vulnerabilities catalog More than 2,000 Palo Alto Networks firewalls hacked exploiting recently patched zero-days Ransomhub ransomware gang claims the hack of Mexican government Legal Affairs Office US DoJ charges five alleged members of the Scattered Spider cybercrime gang Threat actor (..)

Cybercrime

Security Boulevard

JULY 4, 2025

Content warning: Domestic abuse, stalking, controlling behavior, Schadenfreude, irony. The post Yet More Stalkerware Leaks Secret Data: ‘Catwatchful’ is Latest Nasty App appeared first on Security Boulevard.

Social Engineering

SecureWorld News

JANUARY 9, 2025

government than anything else," said Staynings. Protecting military mobile devices Standards and policies will be implemented to secure Department of Defense mobile devices from foreign spyware. Agencies must report any compromises involving foreign spyware over the past two years.

Cybersecurity