Italian authorities confirmed that a journalist, who was alerted by WhatsApp last year of a suspected spyware attack, was indeed hacked. According to a press release from Rome and Naples prosecutors, a technical report confirmed that the phones of journalist Francesco Cancellato and immigration activists Giuseppe Caccia and Luca Casarini were infected with spyware on December 14, 2024.
The report states that the three consecutive attacks suggest they were part of the same campaign. This marks the first independent verification that Cancellato, director of Fanpage, was targeted with spyware. In January 2025, Cancellato and about 90 others were notified by WhatsApp of being targeted with Paragon Solutions spyware, an Israeli company now owned by AE Industrial.
Despite inspecting the Paragon spyware server, Italian authorities found no evidence of Cancellato being targeted, though there was proof of operations against Caccia and Casarini. The identity of Cancellato’s hacker remains unknown.
The Italian Parliamentary Committee for the Security of the Republic, COPASIR, found lawful targeting of Caccia and Casarini but no evidence of an attack on Cancellato. Prosecutors are still investigating to identify Cancellato’s hackers. Italy’s government, led by Prime Minister Giorgia Meloni, denied involvement in Cancellato’s hack and has offered assistance in the inquiry.
Lorenzo Franceschi-Bicchierai can be contacted securely for more information on Paragon and related spyware campaigns. In response to the controversy, Paragon terminated contracts with its Italian government clients.
Spyware scandals are affecting multiple European countries. In Italy, other individuals were also identified as targets, including Fanpage’s Ciro Pellegrino, who received an iPhone attack alert from Apple. The technical report found evidence of spyware on the phones of Cancellato, Caccia, and Casarini but not Pellegrino or four other alleged victims. Pellegrino questioned the report’s findings, noting prior alerts and evidence found by Citizen Lab.
Rome and Naples prosecutors declined to comment, and Polizia Postale directed inquiries to the prosecutors. Paragon and related company REDLattice did not respond. Recently, a Greek court sentenced executives of Intellexa, involved in another spyware scandal, to prison for wiretapping and privacy violations.