Commercial spyware keeps selling through sanctions, verdicts and buyouts

The original edition described an industry under legal pressure yet still growing. Ten months on, both trends held. NSO Group is under US investor control and bound by a permanent WhatsApp injunction, three Intellexa-linked individuals were delisted weeks after Google and Amnesty documented Predator operations continuing, and ICE's Paragon contract closed out while Paragon's chief executive said the company has no way to know whether customers misuse its software.

• Google Threat Intelligence Group counted 90 zero-days exploited in the wild in 2025 and, for the first time since it began tracking, attributed more zero-days to commercial surveillance vendors than to traditional state-sponsored espionage groups.
• A federal court entered the WhatsApp permanent injunction against NSO Group on November 12, 2025, with a final judgment of $4,447,190 after cutting the $167,254,000 punitive award to $4,002,471. The district court and the Ninth Circuit both denied stays, NSO's appeal is pending, and Meta moved for contempt on June 8, 2026.
• Treasury removed three Intellexa-linked individuals from the SDN list on December 30, 2025. Five senators wrote on February 13, 2026 that three of the seven designated individuals were delisted without the bipartisan briefing that committee staff had requested.
• NPR reported in May 2026 that DHS said ICE has no relationship with Paragon or its acquirer. A procurement notice shows the contract closed out on January 20 (NPR gives no year), and ICE's acting director wrote in an April 1 letter that use of the tool complied with the 2023 executive order.
• Apple told TechCrunch it sent a new batch of mercenary spyware threat notifications to users targeted in 110 countries, and says it has now notified users in over 150 countries in total. Apple notifies by lock screen push as well as by email.
• The FCC voted in November 2025 to rescind the January 2025 CALEA declaratory ruling and withdrew the rulemaking that accompanied it, with Commissioner Gomez dissenting.

Mercenary spyware is bought by governments and aimed at specific people. The cost lands on the organizations those people work for, because one infected phone exposes mail, messages and credentials for everyone around it.

• Government officials, journalists and policy experts: Treasury's March 5, 2024 release says Predator was used to target Americans, including U.S. government officials, journalists, and policy experts. Five US senators later wrote that foreign actors deployed it against officials including members of Congress, citing NBC News.
• Journalists and civil society activists: Italy's parliamentary oversight committee acknowledged in June 2025 that Italian intelligence services used Graphite against civil society activists, and Amnesty documented a Predator attempt against a Balochistan human rights lawyer in summer 2025.
• Staff who travel to or deal with countries where Google sent government-backed attack warnings tied to Intellexa customers, including Pakistan, Kazakhstan, Angola, Egypt, Uzbekistan, Saudi Arabia and Tajikistan.
• Telecommunications carriers and their customers, after the FCC rescinded its January 2025 CALEA security ruling in November 2025.
• Public agencies evaluating surveillance or forensic vendors, which carry sanctions, procurement and reputational exposure.

In priority order, highest impact first.

1. 01

   Do firstPatch phones, browsers and messaging apps within days of release and enforce minimum OS versions through MDM.

   Google's 2025 zero-day review advises applying patches as soon as they become available; a patched device breaks the exploit chains already documented.

2. 02

   Enable Lockdown Mode on iPhones and advanced protection on Android for executives, counsel, journalists and anyone who deals with high-risk countries.

   Apple told TechCrunch it has yet to see a case where a device was hacked while Lockdown Mode was enabled.

3. 03

   Treat an Apple or Google threat notification as a security incident: isolate the device, reset credentials and sessions, and get a forensic review.

   A notification may not mean the device was hacked, but it means Apple suspects the person was targeted; Apple sent a new batch to users in 110 countries in August 2026.

4. 04

   Run sanctions and ownership checks on any surveillance, forensic or intrusion vendor before purchase, and re-check annually.

   Delistings, ownership changes and restructurings affected NSO, Intellexa, Candiru and Paragon within the past two years.

5. 05

   Do not assume carrier networks meet the January 2025 CALEA security requirements; keep sensitive calls and messages on end-to-end encrypted apps with disappearing messages.

   The FCC rescinded that ruling in November 2025, so the obligations it created no longer apply.

6. 06

   Give staff a reporting path and a stand-in device plan for suspected targeting, and brief executives before travel to higher-risk jurisdictions.

   Targeting follows people and their contacts; the organizations around them absorb the damage.

7. 07

   Monitor mail and identity logs for sign-ins from a newly compromised phone, and require phishing-resistant MFA on executive accounts.

   Google documented a keylogger in Intellexa's payload, so passwords and codes can be exposed; identity controls limit what the attacker can do next. Z7's 24/7 SOC and Microsoft 365 posture review cover this layer.