Paragon Spyware Targeted a Second Italian Journalist, Ciro Pellegrino

Published on June 13, 2025
Written by:
Lore Apostol
Lore Apostol
Cybersecurity Writer

A second Italian journalist has reportedly been targeted by Paragon spyware, according to a new report released by internet watchdog group Citizen Lab. The journalist, Ciro Pellegrino, works for the Naples-based investigative outlet Fanpage. 

Citizen Lab stated that forensic evidence confirms Paragon’s spy software targeted Pellegrino’s iPhone. This follows similar allegations from Fanpage's editor-in-chief, Francesco Cancellato, who earlier received alerts from WhatsApp indicating misuse of the spyware on his device. 

The targeted individuals and timing of these reports coincide with Fanpage’s critical coverage of Italian Prime Minister Giorgia Meloni’s government, including exposés tying her party’s youth wing to neo-Nazi activity.

Censys result for the IP address contacted by the journalist's phone during the infection period
Censys result for the IP address contacted by the journalist's phone during the infection period | Source: CitizenLab

The spyware, developed by Paragon (a company based in Israel and owned by a U.S. firm), is designed to infiltrate devices and collect sensitive information. Its discovery on Pellegrino’s device has increased scrutiny on its deployment and the adequacy of Italy’s parliamentary investigation into these allegations. 

Attribution to Paragon's Graphite spyware via artifacts found on the devices of Ciro Pellegrino and the unnamed prominent European Journalist
Attribution to Paragon's Graphite spyware via artifacts found on the devices of Ciro Pellegrino and the unnamed prominent European Journalist | Source: CitizenLab

While the government and Paragon recently ended their partnership, disputes remain over who terminated the relationship, with little resolution offered thus far.

An excerpt of the Apple threat notification received by Ciro Pellegrino that triggered the investigation
An excerpt of the Apple threat notification received by Ciro Pellegrino that triggered the investigation | Source: CitizenLab

Marking a worrisome trend, an Italian parliamentary panel disclosed that Paragon’s spyware had also been used to surveil migrant rescue activists. However, the panel denied uncovering evidence directly linking the spyware’s misuse to Fanpage journalists.

The incident has fueled calls for additional investigations into spyware misuse in Italy. 

Sandro Ruotolo, spokesperson for the opposition Democratic Party, emphasized the need for transparency, stating, "We want to know why two Italian journalists were spied on." Natalia Krapiva of Access Now also criticized the current investigations as inadequate, urging stricter oversight.


For a better user experience we recommend using a more modern browser. We support the latest version of the following browsers: For a better user experience we recommend using the latest version of the following browsers: