found this on some telegram channel:

In February 2026, an employee of Paragon Solutions published a photograph on her LinkedIn profile depicting the operation of the Graphite spyware. The post has currently been deleted.

Reut Yamen holds the position of Chief Legal Counsel and Director of Compliance at the Israeli company Paragon Solutions, which specializes in cyber-surveillance technologies. The company was founded in 2019 by a group of former employees of Israeli intelligence services — among them Ehud Schneorson, former commander of Unit 8200 (Israel's equivalent of the U.S. National Security Agency), as well as former Israeli Prime Minister Ehud Barak.

The post was first noticed by technology researcher Yurre van Bergen, who tracks the use and proliferation of spyware worldwide.

The image apparently shows a demonstration interface of the Graphite system. An operator can view messages intercepted from a surveillance target in various services, including WhatsApp, Telegram, Signal, Line, and TikTok.

According to the results of a large-scale investigation conducted by The Citizen Lab in 2025, in 2024 in Italy, dozens of journalists and private individuals were attacked via the WhatsApp messenger using Graphite. A "zero-click" exploit (one that does not require user interaction) was used for this purpose.

Paragon Solutions has (or previously had) contracts with U.S. government agencies, in particular the Drug Enforcement Administration (DEA) and Immigration and Customs Enforcement (ICE).

all 65 comments

sorted by: hot top controversial new old
[–] 101 points 1 day ago (2 children)

Shit I read "Graphite" as "Graphene" and almost fainted

  • source
  • hideshow 2 child comments
  • [–] 101 points 1 day ago (11 children)

    I'm starting to feel sceptical to anything electronic

  • source
  • hideshow 11 child comments
  • [–] 49 points 1 day ago (9 children)

    At some level, you have to accept that there's no panacea to the panopticon. At least, none at the retail level.

    Ffs, flock cameras and facial recognition make even MeatSpace a shitshow of privacy violations.

    Ultimately, the real defense against spying is irrelevance. 99.99% of people simply aren't interesting enough to monitor in a way that matters.

  • source
  • parent
  • hideshow 9 child comments
  • [–] 93 points 1 day ago (4 children)

    And that's the real point.

    Make irrelevance desirable and notoriety risky and you've got a compliant people

  • source
  • parent
  • hideshow 4 child comments
  • [–] 49 points 1 day ago* (2 children)

    even if 99.99% of the populace is irrelevant to them they are still going to collect the data and use it against you if they need to.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 5 points 1 day ago*

    But also make notoriety a source of revenue and irrelevance a job security risk.

    You'll get enthusiastic compliance, as evidenced by the last two years.

    But you'll also get a groundswell of nobodies who are super pissed at you. All this surveillance is ineffectual when defiance occurs at scale.

    When everyone's acting in opposition, nobody gets punished.

  • source
  • parent
  • [–] 1 point 1 day ago (1 child)

    But security through obscurity is no security at all. On top of that, as companies continue to automate spying and the price for spying on an individual falls, we'll be spied on more and more whether we're noteworthy or not

  • source
  • parent
  • hideshow 1 child comment
  • [–] 1 point 23 hours ago

    But security through obscurity is no security at all.

    The survivability onion disagrees.

    On top of that, as companies continue to automate spying and the price for spying on an individual falls, we’ll be spied on more and more whether we’re noteworthy or not

    Just because I can read your email doesn't mean I can distinguish what's important from what's spam.

    The most important element of the flock camera system is your DMV's license plate record system. Without that, none of it works. Even with it, you need an enormous ground presence to make it meaningful.

    Looking unremarkable is absolutely critical in a surveillance state. You should be aware of what takes you off the radar relative to what makes you stick out.

  • source
  • parent
  • [–] 18 points 1 day ago

    First avoid the major social apps. They are designed to give their companies access to your private information for advertising and selling, so of course these have lots of ways for nefarious attacks without user intervention since they aren't likely to spend money keeping them out. Also, wouldn't hurt to move to an OS that better isolates apps (like GrapheneOS) and avoid background services with administrative privileges like iOS or Google Services. GrapheneOS isolates Google services a bit or allows never installing them. IPhone has no real way to mitigate risk outside of the basics like encrypting your device and online data, but the admin services still have access. Not sure how easily they are hacked these days since they haven't really been promoting privacy anymore, but have also started wanting to profit from your data. Still slightly better than google, but way less control over the device which means you're at their mercy. I want even get started on Samsung administrative services...and I don't know the others well.

  • source
  • parent
  • [–] 55 points 1 day ago (14 children)

    can't have a secure messenger if the device itself isn't secure

  • source
  • hideshow 14 child comments
  • [–] 22 points 1 day ago (11 children)

    Which is why I run GrapheneOS.

  • source
  • parent
  • hideshow 11 child comments
  • [–] 7 points 1 day ago (5 children)

    can't have a secure OS if the device itself isn't secure

  • source
  • parent
  • hideshow 5 child comments
  • [–] 7 points 1 day ago (4 children)
  • [–] 1 point 5 hours ago (3 children)

    They are reasonable for what is available, doesn’t make it secure when the device can still do anything.

  • source
  • parent
  • hideshow 3 child comments
  • [–] 1 point 3 hours ago (2 children)

    I don't understand what you're trying to say.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 1 point 1 hour ago (1 child)

    That you need all three: hardware, os, software to be open source to consider it private and secure.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 1 point 1 hour ago

    Sure, but that's maximalist demand. Nobody is going to offer RISCV open hardware in mobile space, especially the baseband. With GOS I can at least be reasonably sure that the cellular radio is really off when I tell it to.

    With WiFi tablets the chances are better.

  • source
  • parent
  • [–] 42 points 1 day ago (2 children)

    There's a lot of fearmongering but here's the vulnerability (I believe it's the same one), from another article:

    The CVE, now publicly listed, was a logic flaw in how iOS processed maliciously crafted media shared via iCloud Link. Apple patched the vulnerability in iOS 18.3.1 on February 10, adding stronger validation checks.

    It was a malicious link delivered via iMessage. You can configure iOS to stop automatically loading link previews which may have prevented the attack

    It's also a good reminder that the vast majority of these cyber attacks have at least some element of social engineering. Stay sensible, lock down your devices, keep them up to date, block unknown USB devices without approval, don't open random links.

    They WANT you to feel hopeless and defeated. They WANT you to think "Well that's it, we have no privacy anymore". If you give into that mindset, you let them win

  • source
  • hideshow 2 child comments
  • [–] 2 points 1 hour ago (1 child)

    There was also the same zero-click issue with WhatsApp, because people can send you a link with a link preview (which would contact the host website for data so it can appear on your phone).

    WhatsApp says that it's been fixed, but I don't trust any closed source apps that says they've plugged the hole (especially Meta). More like charging entry at this point.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 1 point 55 minutes ago

    WhatsApp says that it’s been fixed, but I don’t trust any closed source apps …

    Yup. They already sell out their users to advertisers. What do people think they'll do for domestic and allied intelligence agencies.

  • source
  • parent
  • [–] 46 points 1 day ago (5 children)

    Man we really just need to block all forms of trade relationships with Israel, like we do with China but even more so. and then maybe 60% of our issues just to away.

  • source
  • hideshow 5 child comments
  • [–] 55 points 1 day ago (4 children)

    You do realize that spying on Americans is one of the reasons that America keeps Israel around right?

  • source
  • parent
  • hideshow 4 child comments
  • [–] 16 points 1 day ago* (last edited 1 day ago) (3 children)

    And pushing narratives with many ai slop article "news" outlets, selling hacking tools to the us police, boarder patrol, ice, ect.

    Every major tech company has someone in unit 8200 in it, like Facebook etc.

    It's one of the few reasons I suggested this. Theyre literal terrorist and have basicially instilled the same tech that they use on Palestinians here in the united States.

  • source
  • parent
  • hideshow 3 child comments
  • [–] 20 points 1 day ago (2 children)

    israel wouldn't even be capable of being a terrorist nation were it not for the funding, weapons, and protection supplied by the most prolific terrorist nation on earth: the usa.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 41 points 1 day ago (2 children)

    Read: ios and android is woefully insecure. By design.

    If you represent a country, you should be setting up to help your industry and citizens to escape these insecure surveilance capitalism devices.

  • source
  • hideshow 2 child comments
  • [–] 21 points 1 day ago (1 child)

    Hi, I represent a country. That's disgusting. Global surveillance of the citizenry? Ugh, these disgusting insecure private surveillance devices. I mean, there's so many of them though.. Which one? Which one is offering that service?

  • source
  • parent
  • hideshow 1 child comment
  • [–] 13 points 1 day ago (1 child)

    Is there a source for this information? Do we know where the vulnerability is or how it works?

  • source
  • hideshow 1 child comment
  • [–] 1 point 1 day ago

    I think big tech helps Palantir and similars. So if a website has javascript from Google, which most websites have, then you are at risk when visiting that website. One could be hacked this way easily if the operating system is not secure

  • source
  • parent
  • [–] 18 points 1 day ago (13 children)

    Is this any relation to the graphite os?

  • source
  • hideshow 13 child comments
  • [–] 45 points 1 day ago (9 children)
  • [–] 5 points 1 day ago (5 children)

    Thanks, this is what I was wondering. Glad it's not related to the OS.

  • source
  • parent
  • hideshow 5 child comments
  • [–] -5 points 1 day ago* (4 children)

    So genuine question: if the person above didn't reply, would you have likely kept on wondering if there was a connection between those two and if not how long do you think it would be before you looked it up? Would you have?

  • source
  • parent
  • hideshow 4 child comments
  • [–] 8 points 1 day ago* (3 children)

    The sense of community is going to shit because people consistenly belittle other people for asking questions. They probably were capable of looking it up and spending 3-4 minutes reading to find an answer, but they felt asking furthered the conversation and allowed them to connect with someone that may have common interest.

  • source
  • parent
  • hideshow 3 child comments
  • [–] 37 points 1 day ago*

    I think you mean GrapheneOS, the security-hardened Android distribution. No, it is not related to the Graphite spyware, and likely reduces the user's exposure to such attacks.

  • source
  • parent
  • [–] 7 points 1 day ago (4 children)

    Anyone know if using Molly (the Signal fork) would be sufficient protection from this?

  • source
  • hideshow 4 child comments
  • [–] 10 points 1 day ago (1 child)
  • [–] 2 points 23 hours ago* (last edited 21 hours ago)

    Damn, I hadn't heard about this. Is Molly dead? Does anyone know what's going on with it?

    Edit: seems like they're having some issues and there might he an update coming today.

  • source
  • parent
  • [–] 7 points 1 day ago*

    Ever since I've got smart hubs all over my house I kinda figured I should just find a way to stop trying/caring. Now me and my friends will purposely shout all sorts of shady/dubious things around the room to have Google send it over somewhere lol.

    I do sometimes wonder how horrifying I must often look on my phone selfie cam if someone would secretly watch it's feed. Like on the bathroom e.g.

    We should one day just ban the existence of this stuff as a world collective, you'd think people worldwide would hit a limit with this shit. I'm not feeling all that free as I once did. But no ofc, next thing we'll get implants made by big tech.

  • source
  • [–] 1 point 16 minutes ago*

    Hey can I get access so I can do some proper backups of my WhatsApp data and not the crap that WhatsApp calls a backup that requires Google drive.

  • source
  • 2 comments in c/privacy@programming.dev view that post
    [–] 2 points 1 day ago (1 child)

    What if we don’t have any of those

  • source
  • hideshow 1 child comment
  • [–] 10 points 1 day ago

    Doesn't matter because the title is clickbait. If you're owned the game is lost no matter what app/service you have on there. The title could have/should have been "If you're hacked by Graphite you're fucked no matter what"

    Well I guess if the app only displays ciphertext and you have the ability to read it then I guess this might be newsworthy

  • source
  • parent