# ICE's $2M Contract for Clickless Phone Hacking Spyware Graphite spyware can infiltrate phones without any user interaction. - **Source:** [Hacker News: Front Page](https://brifing.si/source/b07aa772-b1a0-4a76-aa18-719c6f9e2dde) - **Published:** 2026-09-03 - **Topic:** [Business](https://brifing.si/c/business) - **Original article:** - **On Brifing:** https://brifing.si/s/25641530-1a8f-4c7f-b4f9-88e49d371660 ## Graphite's Unique Capabilities Developed by Paragon Solutions, Graphite is an advanced commercial spyware that can infiltrate smartphones without requiring users to click links or download files. It can collect data from end-to-end encrypted messaging apps like WhatsApp and Signal. With a $2 million contract with U.S. Immigration and Customs Enforcement (ICE), the software is categorized alongside NSO Group's Pegasus. ## Journalists and Activists Targeted In late 2024, Citizen Lab identified an active Graphite zero-click exploit via WhatsApp. In January 2025, WhatsApp warned about 90 users across 20+ countries. Traces were found on devices of Italian immigration activists Luca Casarini and Giuseppe Caccia, plus journalist Francesco Cancellato. Prosecutors in Rome and Naples confirmed infections dated to early December 14, 2024. ## Apple Devices Also at Risk Researchers proved Graphite could target Apple devices. In Jan-Feb 2025, the spyware compromised an unnamed European journalist's iPhone using a previously unknown iMessage vulnerability. Italian journalist Ciro Pellegrino was targeted through the same iMessage account. Apple patched the vulnerability in iOS 18.3.1. ## Legal and Ethical Debates in Italy Italy's parliamentary intelligence committee confirmed Graphite was legally used to monitor migrant activists like Casarini and Caccia, but not journalist Cancellato. Paragon claimed it terminated Italian contracts after authorities refused to investigate illegal use. Italian officials called it a mutual decision, stating intelligence record inspections would expose classified information. ## Operational Details Revealed by Leak In February 2026, Paragon's general counsel posted a LinkedIn photo accidentally showing Graphite's dashboard. The deleted image revealed a Czech number codenamed 'Valentina', February 10 interception records, and interfaces for WhatsApp, Signal, Telegram, and LINE. The panel displayed interception status and a warrant expiration field. ## Paragon's Background and Acquisition Founded in Israel in 2019 with ex-PM Ehud Barak's support and Unit 8200 veterans, Paragon was reportedly acquired by Florida's AE Industrial Partners for $500M+ in December 2024. Citizen Lab found shares transferred to a U.S. parent company on December 13. The deal highlights the lucrative nature of commercial spyware. ## How Zero-Click Attacks Work Graphite-style zero-click exploits leverage phones' automatic message/file scanning. Attackers send specially crafted data exploiting hidden flaws. When processed, these flaws execute commands to implant spyware within legitimate apps—all without user interaction. Information transmits to operators invisibly, bypassing encryption by accessing decrypted messages locally. ## Future of Commercial Spyware Industry Graphite and Pegasus represent 'mercenary spyware'—developed by private firms for government intelligence/law enforcement. Their use against civilians like journalists sparks global ethical debates. The $500M acquisition demonstrates the industry's profitability, raising concerns about insufficient oversight of these powerful surveillance tools sold across borders. ## Sources covering this story - https://www.military.com/ice-has-a-2-million-contract-for-spyware-that-can-hack-phones-without-a-click — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._