Meta Uncovers Zero-Click WhatsApp Spyware Targeting Journalists and Civil Society Members

Zero-Click WhatsApp Spyware Targeted Journalists and Civil Society Members

Meta, the parent company of WhatsApp, has discovered a zero-click spyware attack that targeted approximately 90 journalists and other civil society members. A zero-click attack means that victims do not need to interact with any content to be compromised; simply receiving a message is enough to infect their devices.

The attack utilized Paragon Solutions' Graphite spyware, which is similar to the notorious Pegasus spyware from NSO Group. Both are used by governments worldwide and pose significant security risks. Meta has notified the affected individuals and is considering legal action against Paragon.

WhatsApp disrupted the campaign and identified that the infection vector was likely a malicious PDF file sent via group chats. The Citizen Lab at the University of Toronto provided some information to help WhatsApp understand the attack, and they are expected to publish a detailed report in the future.