Italian authorities confirmed that a journalist who was alerted by WhatsApp last year of a suspected spyware attack on his phone was indeed hacked.
In a press release sent to journalists on Thursday, the public prosecutors’ offices in Rome and Naples, which are investigating the spyware scandal in the country, said that a technical report concluded that the phones of journalist Francesco Cancellato, as well as Giuseppe Caccia and Luca Casarini, two immigration activists, all showed traces of having been infected with spyware on the “early hours” of December 14, 2024.
“The execution of three consecutive attacks on the same night suggests that they may have been part of the same infection campaign,” the technical report said, according to the press release.
The full report is not yet public.
This is the first independent confirmation that Cancellato, who is the director of the news website Fanpage, was hacked with spyware. In January 2025, Cancellato and around 90 other people, including journalists and members of civil society, were alerted by WhatsApp that they had been targeted with spyware made by Paragon Solutions, an Israeli-based company now owned by American private equity firm AE Industrial.
According to the press release, Italian judicial authorities inspected the Paragon spyware server used by the intelligence agency, AISI, to target the phones of its targets. While the judicial authorities found evidence of operations against Caccia and Casarini, it found no evidence of an operation against Cancellato.
It remains unclear who hacked Cancellato’s phone.
Contact Us Do you have more information about Paragon, and this or other spyware campaigns? From a non-work device, you can contact Lorenzo Franceschi-Bicchierai securely on Signal at +1 917 257 1382, or via Telegram and Keybase @lorenzofb, or . Do you have more information about Paragon, and this or other spyware campaigns? From a non-work device, you can contact Lorenzo Franceschi-Bicchierai securely on Signal at +1 917 257 1382, or via Telegram and Keybase @lorenzofb, or email
By June 2025, an investigation by the Italian Parliamentary Committee for the Security of the Republic, known as COPASIR, concluded that Italian intelligence agencies had lawfully targeted Caccia and Casarini, but the committee found no evidence of a hack against Cancellato.
The prosecutors’ offices said they will continue to investigate to identify Cancellato’s hackers.
... continue reading