Citizen Lab publishes report on Paragon, an Israeli spyware vendor

Among the clients of its spyware Graphite are reportedly government entities from Australia, Canada, Cyprus, Denmark, Israel, and Singapore.

Citizen Lab, the spyware research group at the University of Toronto, published a report on 19 March 2025 about the operations of Israeli company Paragon Solutions. Founded in 2019, the firm notably sells the spyware Graphite. It claims to impose safeguards to prevent the misuse of its tools.

Citizen Lab was able to map out Graphite’s infrastructure, identifying 150 IP addresses likely linked to clients of the spyware. Several belong to government entities from six countries: Australia, Canada, Cyprus, Denmark, Israel, and Singapore. The investigation also uncovered links between Paragon and the Ontario Provincial Police in Canada, with evidence suggesting regular use of spyware by the agency.

Citizen Lab also described its role in identifying and mitigating a zero-day vulnerability in WhatsApp that was actively exploited by Graphite. Meta’s instant messaging platform disclosed the incident on 31 January 2025, stating it had notified 90 individuals that a Paragon spyware had infected their smartphones. Several members of Italian civil society were among those affected.