Graphite: The Israeli Spyware That Can Hack Your iPhone Without a Click

🕵️ What is Graphite? (Israeli Spyware Explained)

Graphite is a zero-click spyware built by Paragon Solutions, an Israeli company founded in 2019. It's sold to government agencies — including a confirmed $2 million contract with U.S. ICE in 2025 — and has been used to target journalists, activists, and civil society members.

Why it's dangerous: unlike older spyware (like Pegasus) that often needed you to click a malicious link, Graphite exploits flaws in apps like iMessage and WhatsApp to install itself with zero user interaction — no click, no download, nothing.

🧠 How It Actually Infects Your Phone

Forget "phone jumps to phone" — that's not how it works. Graphite uses zero-day exploits in messaging apps:

Confirmed real-world cases:

• CVE-2025-43200 — an iMessage-based exploit chain, patched by Apple in iOS 18.3.1. Citizen Lab confirmed two journalists were infected in Jan–Feb 2025 while running fully updated iPhones.
• CVE-2025-27363 — a WhatsApp-delivered exploit (FreeType font rendering bug) used to hit Android devices.
• WhatsApp directly disrupted a Paragon campaign and notified over 90 targeted individuals across ~24 countries, including journalists in Italy.
• Citizen Lab has traced suspected Paragon government customers to Australia, Canada, Cyprus, Denmark, Israel, and Singapore, and documented an Ontario Provincial Police connection.

💀 What Graphite Steals

• Messages from encrypted apps — WhatsApp, Signal — read before encryption/after decryption
• Call logs, contacts, photos, GPS location
• Live microphone and camera access
• Full device-level control once installed

🛡️ How to Protect Yourself

1. Turn on Lockdown Mode (iOS 16+)
   Settings → Privacy & Security → Lockdown Mode → Turn On
   Disables many of the attack surfaces zero-click exploits rely on.
2. Scan with MVT (Mobile Verification Toolkit) — free, built by Amnesty International's Security Lab:
   
   pip3 install mvt
   mvt-ios check-backup /path/to/backup
3. Update iOS/Android immediately whenever a security patch drops — both confirmed CVEs above were fixed by vendor patches.
4. Reboot your phone regularly. Some spyware implants don't persist across a restart.
5. If you're a journalist, activist, or handle sensitive data and get a threat notification from Apple, Meta, or Google — take it seriously and contact Citizen Lab or a digital security org, don't ignore it.

🔥 Bottom Line

Graphite proves that "I don't click suspicious links" isn't enough anymore. Zero-click exploits in apps you already trust — iMessage, WhatsApp — can compromise a fully updated phone. Patch fast, use Lockdown Mode if you're high-risk, and treat security warnings from Apple/WhatsApp/Google as real, not spam.