Forensic investigation confirmed that Paragon’s Graphite spyware was used in zero-click attacks on iOS devices belonging to European journalists. The attacks exploited a zero-day vulnerability in iOS 18.2.1 through iMessage, leading to remote code execution and stealthy spyware installation. #GraphiteSpyware #CVE-2025-43200
Keypoints
- Paragon’s Graphite spyware was used in targeted zero-click attacks against journalists’ iPhones.
- The attacks exploited a zero-day vulnerability in iOS 18.2.1, CVE-2025-43200, via iMessage.
- Apple released an iOS update (18.3.1) to fix the vulnerability in February 2025.
- The spyware contacts command-and-control servers post-infection for further instructions.
- Citizen Lab linked these attacks to Paragon’s Graphite spyware with high confidence, following investigations.