226
submitted 16 hours ago by redti@lemmy.zip to c/privacy@lemmy.ml

cross-posted from: https://lemmy.today/post/63197390

found this on some telegram channel:

In February 2026, an employee of Paragon Solutions published a photograph on her LinkedIn profile depicting the operation of the Graphite spyware. The post has currently been deleted.

Reut Yamen holds the position of Chief Legal Counsel and Director of Compliance at the Israeli company Paragon Solutions, which specializes in cyber-surveillance technologies. The company was founded in 2019 by a group of former employees of Israeli intelligence services — among them Ehud Schneorson, former commander of Unit 8200 (Israel's equivalent of the U.S. National Security Agency), as well as former Israeli Prime Minister Ehud Barak.

The post was first noticed by technology researcher Yurre van Bergen, who tracks the use and proliferation of spyware worldwide.

The image apparently shows a demonstration interface of the Graphite system. An operator can view messages intercepted from a surveillance target in various services, including WhatsApp, Telegram, Signal, Line, and TikTok.

According to the results of a large-scale investigation conducted by The Citizen Lab in 2025, in 2024 in Italy, dozens of journalists and private individuals were attacked via the WhatsApp messenger using Graphite. A "zero-click" exploit (one that does not require user interaction) was used for this purpose.

Paragon Solutions has (or previously had) contracts with U.S. government agencies, in particular the Drug Enforcement Administration (DEA) and Immigration and Customs Enforcement (ICE).

top 44 comments
sorted by: hot top new old
[-] freedickpics@lemmy.ml 6 points 24 minutes ago

There's a lot of fearmongering but here's the vulnerability (I believe it's the same one), from another article:

The CVE, now publicly listed, was a logic flaw in how iOS processed maliciously crafted media shared via iCloud Link. Apple patched the vulnerability in iOS 18.3.1 on February 10, adding stronger validation checks.

It was a malicious link delivered via iMessage. You can configure iOS to stop automatically loading link previews which may have prevented the attack

It's also a good reminder that the vast majority of these cyber attacks have at least some element of social engineering. Stay sensible, lock down your devices, keep them up to date, block unknown USB devices without approval, don't open random links.

They WANT you to feel hopeless and defeated. They WANT you to think "Well that's it, we have no privacy anymore". If you give into that mindset, you let them win

[-] son_of_darkness@lemmy.world 2 points 10 minutes ago

Shit I read "Graphite" as "Graphene" and almost fainted

[-] chconnor@lemmy.world 3 points 2 hours ago* (last edited 2 hours ago)

Ever since I've got smart hubs all over my house I kinda figured I should just find a way to stop trying/caring. Now me and my friends will purposely shout all sorts of shady/dubious things around the room to have Google send it over somewhere lol.

I do sometimes wonder how horrifying I must often look on my phone selfie cam if someone would secretly watch it's feed. Like on the bathroom e.g.

We should one day just ban the existence of this stuff as a world collective, you'd think people worldwide would hit a limit with this shit. I'm not feeling all that free as I once did. But no ofc, next thing we'll get implants made by big tech.

[-] umbrella@lemmy.ml 34 points 9 hours ago

can't have a secure messenger if the device itself isn't secure

[-] eleitl@lemmy.zip 12 points 4 hours ago

Which is why I run GrapheneOS.

[-] freedickpics@lemmy.ml 1 points 38 minutes ago

That's only one half, the person you're talking to might not be running a secure device

[-] citizensongbird@lemmy.world 8 points 2 hours ago

I'm glad you said this because I was thinking, "Wait a second, isn't Graphite that OS that runs on Pixels? Is nothing sacred?" But no. That's Graphene, an important distinction. Cynical subroutine aborted.

[-] JakenVeina@midwest.social 4 points 2 hours ago

Oh good lord, I thought Graphebe was actually what they were TALKING about for a minute, I was EXTREMELY taken aback.

[-] RedGreenBlue@lemmy.zip 38 points 13 hours ago

Read: ios and android is woefully insecure. By design.

If you represent a country, you should be setting up to help your industry and citizens to escape these insecure surveilance capitalism devices.

[-] apiaceae@quokk.au 17 points 12 hours ago

Hi, I represent a country. That's disgusting. Global surveillance of the citizenry? Ugh, these disgusting insecure private surveillance devices. I mean, there's so many of them though.. Which one? Which one is offering that service?

[-] Reannlegge@lemmy.ca 13 points 10 hours ago

Hi representative of a cauntry, I am Big tech is it not great how when you scratch my back I scratch your back and we watch these little people.

[-] FoxAlive@lemmy.zip 44 points 14 hours ago

Man we really just need to block all forms of trade relationships with Israel, like we do with China but even more so. and then maybe 60% of our issues just to away.

[-] SpikedIguana@sh.itjust.works 44 points 14 hours ago

You do realize that spying on Americans is one of the reasons that America keeps Israel around right?

[-] MaxLemminist@lemmy.ml 23 points 14 hours ago

From Amnesty (in 2025):
For over a year, the European Commission has failed to implement the recommendations of the European Parliament Committee of Inquiry’s recommendations regarding Pegasus and similar surveillance spyware (PEGA), leaving activists, journalists, and other vulnerable individuals exposed to these dangerous surveillance tools.

[-] FoxAlive@lemmy.zip 12 points 14 hours ago* (last edited 14 hours ago)

And pushing narratives with many ai slop article "news" outlets, selling hacking tools to the us police, boarder patrol, ice, ect.

Every major tech company has someone in unit 8200 in it, like Facebook etc.

It's one of the few reasons I suggested this. Theyre literal terrorist and have basicially instilled the same tech that they use on Palestinians here in the united States.

[-] dusk@piefed.social 18 points 11 hours ago

israel wouldn't even be capable of being a terrorist nation were it not for the funding, weapons, and protection supplied by the most prolific terrorist nation on earth: the usa.

[-] TachyonTele_Esq@piefed.social 8 points 11 hours ago

It's a symbiotic relationship

[-] FoxAlive@lemmy.zip 2 points 6 hours ago

Was going to say more a disfunctional relationship where both parties are physically abusive and will visit each other in prison.

[-] ehyuman@lemmy.dbzer0.com 88 points 16 hours ago

I'm starting to feel sceptical to anything electronic

[-] irotsoma@piefed.blahaj.zone 16 points 12 hours ago

First avoid the major social apps. They are designed to give their companies access to your private information for advertising and selling, so of course these have lots of ways for nefarious attacks without user intervention since they aren't likely to spend money keeping them out. Also, wouldn't hurt to move to an OS that better isolates apps (like GrapheneOS) and avoid background services with administrative privileges like iOS or Google Services. GrapheneOS isolates Google services a bit or allows never installing them. IPhone has no real way to mitigate risk outside of the basics like encrypting your device and online data, but the admin services still have access. Not sure how easily they are hacked these days since they haven't really been promoting privacy anymore, but have also started wanting to profit from your data. Still slightly better than google, but way less control over the device which means you're at their mercy. I want even get started on Samsung administrative services...and I don't know the others well.

[-] UnderpantsWeevil@lemmy.world 43 points 16 hours ago

At some level, you have to accept that there's no panacea to the panopticon. At least, none at the retail level.

Ffs, flock cameras and facial recognition make even MeatSpace a shitshow of privacy violations.

Ultimately, the real defense against spying is irrelevance. 99.99% of people simply aren't interesting enough to monitor in a way that matters.

[-] essell@lemmy.world 73 points 16 hours ago

And that's the real point.

Make irrelevance desirable and notoriety risky and you've got a compliant people

[-] TrollTrollrolllol@lemmy.world 43 points 16 hours ago* (last edited 16 hours ago)

even if 99.99% of the populace is irrelevant to them they are still going to collect the data and use it against you if they need to.

[-] notacat@sh.itjust.works 8 points 13 hours ago

Massively easier to find/create relevance now that LLMs can be run against the data. Now imagine all the mistakes it could make.

[-] TrollTrollrolllol@lemmy.world 7 points 13 hours ago

We don't have to imagine, it's already making those mistakes. But don't worry, taxpayers will fund the settlements....

[-] UnderpantsWeevil@lemmy.world 4 points 15 hours ago* (last edited 15 hours ago)

But also make notoriety a source of revenue and irrelevance a job security risk.

You'll get enthusiastic compliance, as evidenced by the last two years.

But you'll also get a groundswell of nobodies who are super pissed at you. All this surveillance is ineffectual when defiance occurs at scale.

When everyone's acting in opposition, nobody gets punished.

[-] Onyx376@lemmy.ml 7 points 15 hours ago

Those 99.99% of "uninteresting" people who make up the trillions of the Big Tech data market

[-] geneva_convenience@lemmy.ml 12 points 14 hours ago

You must assume that anything you communicate electronically can be traced back to you. Even if it's encrypted, if they just hack your OS and read the messages from a screen capture they can still access it.

[-] TiredTiger@lemmy.ml 7 points 10 hours ago

Anyone know if using Molly (the Signal fork) would be sufficient protection from this?

[-] artyom@piefed.social 11 points 12 hours ago

Is there a source for this information? Do we know where the vulnerability is or how it works?

[-] Clark@lemmy.ml 1 points 2 hours ago

I think big tech helps Palantir and similars. So if a website has javascript from Google, which most websites have, then you are at risk when visiting that website. One could be hacked this way easily if the operating system is not secure

[-] aphonefriend@lemmy.dbzer0.com 16 points 16 hours ago

Is this any relation to the graphite os?

[-] Akip@piefed.world 71 points 16 hours ago

what you're thinking of is grapheneOS not graphite the spyware

[-] Babalugats@feddit.uk 43 points 15 hours ago
[-] artyom@piefed.social 1 points 1 hour ago

GenAI website doesn't seem the most trustworthy source...

[-] aphonefriend@lemmy.dbzer0.com 4 points 12 hours ago

Thanks, this is what I was wondering. Glad it's not related to the OS.

[-] TootTootComingThru@lemmy.world 0 points 8 hours ago* (last edited 8 hours ago)

So genuine question: if the person above didn't reply, would you have likely kept on wondering if there was a connection between those two and if not how long do you think it would be before you looked it up? Would you have?

[-] LincolnsDogFido@lemmy.zip 4 points 5 hours ago* (last edited 5 hours ago)

The sense of community is going to shit because people consistenly belittle other people for asking questions. They probably were capable of looking it up and spending 3-4 minutes reading to find an answer, but they felt asking furthered the conversation and allowed them to connect with someone that may have common interest.

[-] MBM@lemmy.world 2 points 1 hour ago

Not to mention that there's no way only one person was confused by this

[-] Zak@lemmy.world 38 points 16 hours ago* (last edited 16 hours ago)

I think you mean GrapheneOS, the security-hardened Android distribution. No, it is not related to the Graphite spyware, and likely reduces the user's exposure to such attacks.

[-] TwiddleTwaddle@lemmy.blahaj.zone 12 points 16 hours ago

No it's a spyware tool called Graphite.

this post was submitted on 12 Nov 2026
226 points (99.1% liked)

Privacy

52043 readers
933 users here now

A place to discuss privacy and freedom in the digital world.

Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.

In this community everyone is welcome to post links and discuss topics related to privacy.

Some Rules

Related communities

much thanks to @gary_host_laptop for the logo design :)

founded 7 years ago
MODERATORS