What happened

Between late 2024 and early 2025, several prominent Italian journalists, notably Francesco Cancellato and Ciro Pellegrino of the investigative news site Fanpage.it, discovered their mobile devices had been compromised. The campaign also targeted activists from the NGO Mediterranea Saving Humans.

The breach was executed via "zero-click" exploits on platforms such as WhatsApp and iOS, requiring no interaction from the victims. 

Forensic investigations by Citizen Lab later confirmed the presence of Graphite, a military-grade AI-powered spyware that grants operators full access to messages, encrypted chats, location data, and the device’s microphone and camera. 

The Italian government admitted that seven Italians were targeted but maintained that any surveillance was lawful and overseen by a public prosecutor, denying it engaged in illicit spying. 

However, it offered no explanation for why journalists with no apparent connection to criminal investigations were included.

Why it happened

Italy's intelligence services authorised the use of Paragon's spyware in 2023 and 2024 to monitor a small number of individuals in connection with criminal investigations, including suspected terrorism, people smuggling, and espionage.

The incident was made possible by the availability of "mercenary spyware" sold to government agencies with minimal oversight. The developer, Paragon Solutions, claims its technology is only for "fighting crime," but the lack of transparent auditing allowed the system to be used against civil society. 

Indeed, everything about spyware operates as a "black box": the technology itself, the market in which it is sold, and the use that law enforcement and intelligence agencies make of these tools are all deeply opaque. 

Compounding matters in an apparent attempt to avoid accountability, the Italian government issued increasingly contradictory statements: initially denying journalists had been surveilled, then refusing to answer parliamentary questions by invoking state secrecy.