Skip to content

Topic

Commercial Spyware Industry

Industry of vendors like NSO Group, Cytrox, Intellexa and Paragon that sell phone-hacking spyware to governments, often targeting journalists and activists.

Current stories

securityOne report1 publisher

Confiant ties Discover-Tech's cloaked ad chain to infrastructure Citizen Lab attributes to Candiru

Confiant says an ad from Discover-Tech, caught by its scanner on April 12, 2026, handed off to infrastructure Citizen Lab attributes to Candiru. The script request alone gives the operator the device's advertising ID, IP address and OS.

Publishers:blog.confiant.com

Reality

Evidence55
Adoption
Not scored
Hype gap+25
Incentives40
Confidence55
securityOne report1 publisher

California judge again dismisses El Faro journalists' Pegasus suit against NSO Group

El Faro journalists have lost their Pegasus lawsuit against NSO Group for a second time after a California federal judge found no jurisdiction in the state. Pointing to compromised infrastructure in California did not tie a Salvadoran newsroom's case to the state's courts.

Publishers:therecord.media

Reality

Evidence55
Adoption
Not scored
Hype gap+5
Incentives
Not scored
Confidence62
productOne report1 publisher

Paragon relies on outsiders to catch misuse of its Graphite spyware

Paragon CEO Andrew Boyd says the spyware maker cannot see whom its customers target, and that halting updates leaves their systems ineffective in about 12 hours. Its promise to drop abusive customers therefore waits on outsiders finding the abuse first.

Publishers:wired.com

Reality

Evidence62
Adoption
Not scored
Hype gap+45
Incentives70
Confidence60
productOne report1 publisher

Paragon CEO Andrew Boyd says withholding updates is how the spyware maker cuts off abusers

Paragon CEO Andrew Boyd says the spyware maker can't see who customers target, and withheld updates leave a customer's system ineffective in about 12 hours. Its zero-tolerance misuse policy depends on outside researchers to find abuse before that slow cutoff comes into play.

Publishers:wired.com

Reality

Evidence55
Adoption
Not scored
Hype gap+45
Incentives65
Confidence55
buildOne report1 publisher

Apple's iOS 27.2 beta gates its new Endpoint Security stack behind four separate checks

IRIS C2 found a kernel extension named EndpointSecuritySE in an iOS build Apple released to developers on September 16, along with the entitlement and research-mode checks that decide which clients may read its events.

Publishers:runtimewire.com

Reality

Evidence62
Adoption10
Hype gap+5
Incentives55
Confidence55
buildOne report1 publisher

The Crypto Wars Ended, And The Prize Went To Whoever Owns Your Endpoint

Matthew Green's argument is that backdoors lost and lawful access still won, by moving to device exploitation. That relocates the defender's problem from protocol design to fleet integrity.

Publishers:dev.to

Reality

Evidence26
Adoption
Not scored
Hype gap+38
Incentives44
Confidence33