ICE Holds $2 Million Contract for Paragon’s Graphite Spyware Capable of Zero-Click Phone Hacks

Graphite is a commercial spyware tool developed by Paragon Solutions that can infiltrate smartphones without requiring the target to click a link, open an attachment, or download any content knowingly. This zero-click capability allows the spyware to exploit vulnerabilities in messaging apps like WhatsApp and iMessage to silently access private communications. Similar to the well-known Pegasus spyware, Graphite is sold to government agencies for intelligence and law enforcement purposes. However, unlike Pegasus, Graphite is primarily designed to extract information from messaging applications rather than take full control of a device. The spyware bypasses encryption protections by operating within the device after messages are decrypted, enabling it to read conversations from apps such as WhatsApp and Signal. Researchers have confirmed Graphite’s ability to exploit zero-click vulnerabilities in these platforms, with Citizen Lab assisting WhatsApp in blocking an active exploit in late 2024. Investigations revealed that Graphite was used to target journalists and immigration activists in Europe, including Italian figures Luca Casarini, Giuseppe Caccia, and Francesco Cancellato. Italian prosecutors confirmed the presence of spyware traces on their phones dating back to December 2024. Additional forensic analysis showed Graphite’s capability to compromise Apple devices via an iMessage vulnerability later patched by Apple. Italy’s parliamentary intelligence committee acknowledged the legal use of Graphite by Italian agencies for immigration and national security surveillance but found no evidence of its use against journalist Cancellato. Disputes arose between Paragon and Italian officials regarding contract termination and access to intelligence records. In early 2026, a leaked image of Graphite’s control panel surfaced on LinkedIn, revealing features such as interception records and integration with multiple messaging apps. Paragon, founded in Israel in 2019 with backing from former Prime Minister Ehud Barak and former military intelligence personnel, emphasizes responsible sales only to vetted democratic governments and prohibits unlawful targeting. Despite these claims, the Italian cases highlight the challenges in monitoring spyware use, as victims often remain unaware of infections unless detected by technology companies or researchers. In September 2024, ICE entered a $2 million contract with Paragon, though the specific use of Graphite was not publicly disclosed. A stop-work order was initially imposed to review compliance with a 2023 executive order restricting commercial spyware with security or human rights risks. The order was lifted in August 2025, allowing the contract to proceed without public details on safeguards or target criteria. Graphite’s ability to access private communications without user knowledge presents significant privacy concerns. While manufacturers may promise responsible use, the covert nature of such spyware complicates oversight and accountability, especially when deployed by government agencies.