cross-posted from: https://lemmy.today/post/63197390
found this on some telegram channel:
In February 2026, an employee of Paragon Solutions published a photograph on her LinkedIn profile depicting the operation of the Graphite spyware. The post has currently been deleted.
Reut Yamen holds the position of Chief Legal Counsel and Director of Compliance at the Israeli company Paragon Solutions, which specializes in cyber-surveillance technologies. The company was founded in 2019 by a group of former employees of Israeli intelligence services — among them Ehud Schneorson, former commander of Unit 8200 (Israel’s equivalent of the U.S. National Security Agency), as well as former Israeli Prime Minister Ehud Barak.
The post was first noticed by technology researcher Yurre van Bergen, who tracks the use and proliferation of spyware worldwide.
The image apparently shows a demonstration interface of the Graphite system. An operator can view messages intercepted from a surveillance target in various services, including WhatsApp, Telegram, Signal, Line, and TikTok.
According to the results of a large-scale investigation conducted by The Citizen Lab in 2025, in 2024 in Italy, dozens of journalists and private individuals were attacked via the WhatsApp messenger using Graphite. A “zero-click” exploit (one that does not require user interaction) was used for this purpose.
Paragon Solutions has (or previously had) contracts with U.S. government agencies, in particular the Drug Enforcement Administration (DEA) and Immigration and Customs Enforcement (ICE).
Shit I read “Graphite” as “Graphene” and almost fainted
Same comrade was about to go live in a forest
If I could without the government taking it off me or arresting me, I would.
There’s a lot of fearmongering but here’s the vulnerability (I believe it’s the same one), from another article:
The CVE, now publicly listed, was a logic flaw in how iOS processed maliciously crafted media shared via iCloud Link. Apple patched the vulnerability in iOS 18.3.1 on February 10, adding stronger validation checks.
It was a malicious link delivered via iMessage. You can configure iOS to stop automatically loading link previews which may have prevented the attack
It’s also a good reminder that the vast majority of these cyber attacks have at least some element of social engineering. Stay sensible, lock down your devices, keep them up to date, block unknown USB devices without approval, don’t open random links.
They WANT you to feel hopeless and defeated. They WANT you to think “Well that’s it, we have no privacy anymore”. If you give into that mindset, you let them win
Ever since I’ve got smart hubs all over my house I kinda figured I should just find a way to stop trying/caring. Now me and my friends will purposely shout all sorts of shady/dubious things around the room to have Google send it over somewhere lol.
I do sometimes wonder how horrifying I must often look on my phone selfie cam if someone would secretly watch it’s feed. Like on the bathroom e.g.
We should one day just ban the existence of this stuff as a world collective, you’d think people worldwide would hit a limit with this shit. I’m not feeling all that free as I once did. But no ofc, next thing we’ll get implants made by big tech.
can’t have a secure messenger if the device itself isn’t secure
Which is why I run GrapheneOS.
can’t have a secure OS if the device itself isn’t secure
These are reasonable demands https://grapheneos.org/faq#future-devices
That’s only one half, the person you’re talking to might not be running a secure device
If you’re an org who’s serious you will of course control the hardware platform, too.
I’m glad you said this because I was thinking, “Wait a second, isn’t Graphite that OS that runs on Pixels? Is nothing sacred?” But no. That’s Graphene, an important distinction. Cynical subroutine aborted.
Cynical subroutine aborted.
Nothing to see here. Beep boop.
Oh good lord, I thought Graphebe was actually what they were TALKING about for a minute, I was EXTREMELY taken aback.
Read: ios and android is woefully insecure. By design.
If you represent a country, you should be setting up to help your industry and citizens to escape these insecure surveilance capitalism devices.
Hi, I represent a country. That’s disgusting. Global surveillance of the citizenry? Ugh, these disgusting insecure private surveillance devices. I mean, there’s so many of them though… Which one? Which one is offering that service?
Hi representative of a cauntry, I am Big tech is it not great how when you scratch my back I scratch your back and we watch these little people.
I’m starting to feel sceptical to anything electronic
First avoid the major social apps. They are designed to give their companies access to your private information for advertising and selling, so of course these have lots of ways for nefarious attacks without user intervention since they aren’t likely to spend money keeping them out. Also, wouldn’t hurt to move to an OS that better isolates apps (like GrapheneOS) and avoid background services with administrative privileges like iOS or Google Services. GrapheneOS isolates Google services a bit or allows never installing them. IPhone has no real way to mitigate risk outside of the basics like encrypting your device and online data, but the admin services still have access. Not sure how easily they are hacked these days since they haven’t really been promoting privacy anymore, but have also started wanting to profit from your data. Still slightly better than google, but way less control over the device which means you’re at their mercy. I want even get started on Samsung administrative services…and I don’t know the others well.
At some level, you have to accept that there’s no panacea to the panopticon. At least, none at the retail level.
Ffs, flock cameras and facial recognition make even MeatSpace a shitshow of privacy violations.
Ultimately, the real defense against spying is irrelevance. 99.99% of people simply aren’t interesting enough to monitor in a way that matters.
But security through obscurity is no security at all. On top of that, as companies continue to automate spying and the price for spying on an individual falls, we’ll be spied on more and more whether we’re noteworthy or not
But security through obscurity is no security at all.
The survivability onion disagrees.
On top of that, as companies continue to automate spying and the price for spying on an individual falls, we’ll be spied on more and more whether we’re noteworthy or not
Just because I can read your email doesn’t mean I can distinguish what’s important from what’s spam.
The most important element of the flock camera system is your DMV’s license plate record system. Without that, none of it works. Even with it, you need an enormous ground presence to make it meaningful.
Looking unremarkable is absolutely critical in a surveillance state. You should be aware of what takes you off the radar relative to what makes you stick out.
And that’s the real point.
Make irrelevance desirable and notoriety risky and you’ve got a compliant people
even if 99.99% of the populace is irrelevant to them they are still going to collect the data and use it against you if they need to.
Massively easier to find/create relevance now that LLMs can be run against the data. Now imagine all the mistakes it could make.
We don’t have to imagine, it’s already making those mistakes. But don’t worry, taxpayers will fund the settlements…
But also make notoriety a source of revenue and irrelevance a job security risk.
You’ll get enthusiastic compliance, as evidenced by the last two years.
But you’ll also get a groundswell of nobodies who are super pissed at you. All this surveillance is ineffectual when defiance occurs at scale.
When everyone’s acting in opposition, nobody gets punished.
Those 99.99% of “uninteresting” people who make up the trillions of the Big Tech data market
You must assume that anything you communicate electronically can be traced back to you. Even if it’s encrypted, if they just hack your OS and read the messages from a screen capture they can still access it.
Man we really just need to block all forms of trade relationships with Israel, like we do with China but even more so. and then maybe 60% of our issues just to away.
You do realize that spying on Americans is one of the reasons that America keeps Israel around right?
From Amnesty (in 2025):
For over a year, the European Commission has failed to implement the recommendations of the European Parliament Committee of Inquiry’s recommendations regarding Pegasus and similar surveillance spyware (PEGA), leaving activists, journalists, and other vulnerable individuals exposed to these dangerous surveillance tools.And pushing narratives with many ai slop article “news” outlets, selling hacking tools to the us police, boarder patrol, ice, ect.
Every major tech company has someone in unit 8200 in it, like Facebook etc.
It’s one of the few reasons I suggested this. Theyre literal terrorist and have basicially instilled the same tech that they use on Palestinians here in the united States.
israel wouldn’t even be capable of being a terrorist nation were it not for the funding, weapons, and protection supplied by the most prolific terrorist nation on earth: the usa.
It’s a symbiotic relationship
Was going to say more a disfunctional relationship where both parties are physically abusive and will visit each other in prison.
Is there a source for this information? Do we know where the vulnerability is or how it works?
I think big tech helps Palantir and similars. So if a website has javascript from Google, which most websites have, then you are at risk when visiting that website. One could be hacked this way easily if the operating system is not secure
Anyone know if using Molly (the Signal fork) would be sufficient protection from this?
the issue is the os being insecure, not the apps
Almost certainly not
Damn, I hadn’t heard about this. Is Molly dead? Does anyone know what’s going on with it?
Is this any relation to the graphite os?
what you’re thinking of is grapheneOS not graphite the spyware
Not related to Graphite OS, Nor Graphene OS
This is it:
https://stateofsurveillance.org/news/paragon-graphite-spyware-ice-phone-hacking-2026/
GenAI website doesn’t seem the most trustworthy source…
Thanks, this is what I was wondering. Glad it’s not related to the OS.
So genuine question: if the person above didn’t reply, would you have likely kept on wondering if there was a connection between those two and if not how long do you think it would be before you looked it up? Would you have?
The sense of community is going to shit because people consistenly belittle other people for asking questions. They probably were capable of looking it up and spending 3-4 minutes reading to find an answer, but they felt asking furthered the conversation and allowed them to connect with someone that may have common interest.
Not to mention that there’s no way only one person was confused by this
I think you mean GrapheneOS, the security-hardened Android distribution. No, it is not related to the Graphite spyware, and likely reduces the user’s exposure to such attacks.
No it’s a spyware tool called Graphite.
