Italian prosecutors have confirmed that journalist Francesco Cancellato’s phone was infected with spyware, validating earlier warnings issued by WhatsApp about a suspected surveillance attack. The confirmation comes from a technical investigation conducted by prosecutors in Rome and Naples into a wider spyware scandal involving journalists and civil society members in Italy.
The prosecutors said traces of spyware were found on Cancellato’s device along with the phones of immigration activists Giuseppe Caccia and Luca Casarini.
Technical Report Links Attacks To Same Night
According to a press release issued Thursday, a technical report concluded that the three devices were infected during the early hours of December 14, 2024.
“The execution of three consecutive attacks on the same night suggests that they may have been part of the same infection campaign,” the report said.
The full technical report has not yet been made public.
WhatsApp Alerts First Warned Potential Targets
Cancellato, who directs the Italian news website Fanpage, had previously been alerted by WhatsApp in January 2025 that his phone may have been targeted with spyware.
Around 90 individuals received similar warnings at the time. The alerts indicated that the suspected surveillance involved spyware developed by Paragon Solutions, an Israeli company whose Graphite spyware product has been used by government clients.
Paragon Solutions is owned by the U.S. private equity firm AE Industrial.
The list of people alerted included journalists and members of civil society organizations.
Inspection Of Intelligence Agency Servers
Italian judicial authorities also examined a server running Paragon spyware that had been used by Italy’s intelligence agency AISI for surveillance operations.
According to prosecutors, investigators confirmed that the system had been used in operations targeting activists Caccia and Casarini.
However, the inspection did not uncover evidence that the same server had been used to target Cancellato.
Authorities said the identity of the party responsible for the journalist’s infection remains unknown.
Earlier Parliamentary Inquiry Reached Different Finding
In June 2025, the Italian Parliamentary Committee for the Security of the Republic, known as COPASIR, conducted a separate inquiry into the spyware case.
That investigation concluded that Italian intelligence agencies had lawfully targeted Caccia and Casarini but found no evidence that Cancellato had been hacked.
Prosecutors said their investigation will continue as they attempt to identify the party responsible for the attack on the journalist.
Government Denies Involvement
Italy’s government, led by Prime Minister Giorgia Meloni, has denied involvement in the surveillance.
During a January press conference, Meloni said the government would cooperate with investigations into the incident.
Her office said the government “is offering all its assistance and all the answers it can provide to help clarify this issue.”
Cancellato criticized the government’s handling of the case in an article published Thursday.
“We are asking for clarity,” he wrote. “And we have not received it from the government, which has remained silent whenever possible for a year. And when it didn’t remain silent, it told lies.”
Researchers Question Earlier Investigations
John Scott-Railton, a researcher at the University of Toronto’s Citizen Lab who has studied the Paragon spyware cases in Italy, said the confirmation of Cancellato’s infection raises new questions.
He said the findings “raise serious questions about why no confirmation was surfaced in prior official investigations by the Italian authorities.”
Following the scandal, Paragon canceled its contracts with Italian government customers.
Dispute Over Evidence In Additional Cases
Several other individuals in Italy were also identified as possible spyware targets.
Among them was Ciro Pellegrino, another journalist at Fanpage who received an alert from Apple last year warning that his iPhone may have been targeted.
Researchers at Citizen Lab later concluded that Pellegrino’s phone had been infected with Paragon’s Graphite spyware.
However, the technical report referenced by prosecutors said it only confirmed spyware infections on the phones of Caccia, Casarini, and Cancellato.
Investigators said they did not find evidence of spyware on Pellegrino’s device or on the phones of four other alleged victims.
Pellegrino questioned the discrepancy.
“I’m pretty disconcerted,” he told TechCrunch. “How is it possible that Citizen Lab, an authority on spyware, found evidence that Paragon’s Graphite was on my phone, while the Italian prosecutors’ experts did not? And why would Apple send me the alerts? For fun?”
Authorities And Companies Decline Comment
The prosecutor’s offices in Rome and Naples did not respond to requests for comment about the investigation.
A spokesperson for Italy’s cybercrime unit, Polizia Postale, referred questions to the prosecutors.
Paragon Solutions and REDLattice, a company that merged with the spyware maker following its acquisition by AE Industrial, did not respond to requests for comment.
At the time of the incident, Paragon also maintained a contract with U.S. Immigration and Customs Enforcement.
European Spyware Cases Draw Wider Scrutiny
Italy is the latest European country to face scrutiny over alleged spyware use against journalists and political figures.
Similar scandals have surfaced in Greece, Hungary, Poland, and Spain.
In Greece, a court last month sentenced Tal Dilian and three other executives from the spyware company Intellexa to eight years in prison for illegal wiretapping and privacy violations.
The case was linked to the surveillance scandal known as “Greek Watergate,” in which the Greek government was accused in 2022 of using Intellexa’s Predator spyware to target politicians, journalists, business leaders, and military officials.
Featured image credits: Pickpik
For more stories like it, click the +Follow button at the top of this page to follow us.