Italian prosecutors confirm journalist targeted with Paragon spyware attack

Italian prosecutors have confirmed that a journalist who was warned by WhatsApp last year about a suspected spyware attack on his phone was, in fact, hacked.

In a press release sent to journalists on Thursday, the public prosecutors’ offices in Rome and Naples, which are investigating the spyware scandal in Italy, said that a technical report found that the phones of journalist Francesco Cancellato, along with immigration activists Giuseppe Caccia and Luca Casarini, all showed signs of being infected with spyware in the “early hours” of December 14, 2024.

“The execution of three consecutive attacks on the same night suggests that they may have been part of the same infection campaign,” the technical report said, according to the press release.

The full technical report has not yet been made public.

This marks the first independent confirmation that Cancellato, who serves as director of the news website Fanpage, was hacked using spyware. In January 2025, Cancellato and approximately 90 other individuals — including journalists and members of civil society — were notified by WhatsApp that they had been targeted with spyware developed by Paragon Solutions, an Israeli company now owned by the American private equity firm AE Industrial.

According to the press release, Italian judicial authorities inspected the Paragon spyware server used by the intelligence agency AISI to target phones. While investigators found evidence of operations involving Caccia and Casarini, they found no evidence of an operation involving Cancellato.

It is still not known who compromised Cancellato’s phone.

By June 2025, an investigation by the Italian Parliamentary Committee for the Security of the Republic (COPASIR) concluded that Italian intelligence agencies had lawfully targeted Caccia and Casarini, but found no evidence that Cancellato had been hacked.

The prosecutors’ offices said they will continue their investigation to identify who targeted Cancellato.

The Italian government, led by far-right Prime Minister Giorgia Meloni, has denied carrying out the hack against Cancellato. When the journalist raised the issue during a press conference in January, Meloni said only that her government “is offering all its assistance and all the answers it can provide to help clarify this issue.”

“We are asking for clarity,” Cancellato wrote in an article on Thursday. “And we have not received it from the government, which has remained silent whenever possible for a year. And when it didn’t remain silent, it told lies.”

John Scott-Railton, one of the Citizen Lab researchers who examined the Paragon spyware cases in Italy, said the new disclosure about Cancellato’s phone being hacked “raises serious questions about why no confirmation surfaced in prior official investigations by the Italian authorities.”

Following the scandal, Paragon — whose spyware product is called Graphite — terminated its contracts with its Italian government clients.

Spyware scandals continue to spread across Europe.

In addition to Caccia, Casarini, and Cancellato, several other people in Italy were identified as possible targets of spyware, including Ciro Pellegrino, who also works at Fanpage and was warned last year by Apple about a suspected attack on his iPhone. Researchers at Citizen Lab later concluded that Pellegrino had also been hacked using Paragon spyware.

The technical report cited by the prosecutors’ offices, however, found evidence of spyware only on the phones of Caccia, Casarini, and Cancellato, not on Pellegrino’s device or those of the other four alleged victims.

“I’m pretty disconcerted,” Pellegrino said, adding that he had not yet seen the full technical report. “How is it possible that Citizen Lab, an authority on spyware, found evidence that Paragon’s Graphite was on my phone, while the Italian prosecutors’ experts did not? And why would Apple send me the alerts? For fun?”

The prosecutors’ offices in Rome and Naples did not respond to a request for comment.

Paragon, which as of last year had an active contract with U.S. Immigration and Customs Enforcement, and REDLattice, the company that merged with the spyware maker after AE Industrial acquired it, also did not respond to a request for comment.

Italy is the latest European country to be caught up in a spyware controversy, following similar scandals in Greece, Hungary, Poland, and Spain.

At the end of last month, a Greek court sentenced Tal Dilian and three other executives from spyware maker Intellexa to eight years in prison for illegal wiretapping and privacy violations.

That sentencing was part of the so-called “Greek Watergate” scandal, in which the Greek government was accused in 2022 of using Intellexa’s Predator spyware to hack the phones of politicians, journalists, business executives, and military officials.