The Escalating Threat of Commercial Spyware

The rise of sophisticated commercial spyware has introduced significant risks to global security, privacy, and human rights. These invasive cyber surveillance tools are sold by commercial entities, allowing clients to remotely access electronic devices, extract private content, and manipulate components, frequently without the user's knowledge or consent. Understanding the Commercial Spyware Peril is critical for global defense.

The high demand for these tools has fostered a lucrative industry, marked by massive payments; for instance, over $8,000,000 was paid for a single zero-day exploit. This ensures a steady global supply of hacking tools, often provided to governments.

Technical Threats: The Danger of Zero-Click Exploits

One of the most alarming developments in the spyware ecosystem is the widespread reliance on zero-click exploits. Unlike traditional malware, these highly sophisticated threats require no user interaction whatsoever to infect a device.

Pegasus and ForcedEntry: Total Surveillance

The Israeli cyber-arms company NSO Group developed Pegasus, one of the most notorious examples of commercial spyware. Pegasus is designed for covert and remote installation on mobile phones running both iOS and Android. Once installed, it enables total surveillance, allowing operators to perform several intrusive actions:

• See or listen to phone calls.
• Read messages.
• Track location.
• Collect passwords.
• Remotely activate the device’s microphone and camera.

In 2021, Citizen Lab identified the new Pegasus zero-click exploit, ForcedEntry. ForcedEntry was particularly significant because it circumvented Apple’s BlastDoor security feature, which was designed to prevent such intrusions. Forensic analysis showed that ForcedEntry involved invoking CoreGraphics’ functionality for decoding JBIG2-encoded data within a PDF file, resulting in system crashes upon exploitation. This critical vulnerability was later patched by Apple in iOS 14.8 (identified as CVE-2021-30860).

Widespread Misuse and Human Rights Concerns

Despite NSO Group’s claims that its products are intended for combating crime and terrorism, the spyware has been consistently misused by governments, both democratic and authoritarian, to monitor civil society members.

Victims globally have included:

• Journalists.
• Human rights activists.
• Lawyers.
• Political dissidents.

The surveillance of journalists profoundly threatens free speech and privacy by undermining the protection of sources, potentially deterring them from providing information in the public interest. The consequences of this misuse are severe, posing potential life-threatening risks, enabling political repression, arbitrary detention, and even extrajudicial killings. For instance, the Pegasus Project investigation in 2021 analyzed a leaked list of over 50,000 phone numbers reportedly targeted by NSO customers, including nine Bahraini activists.

US Policy Response and the Paragon Controversy

The proliferation of commercial spyware presents growing counterintelligence and security risks, especially for U.S. Government personnel overseas. The Biden-Harris Administration responded with specific policy actions:

• Executive Order 14093 (March 27, 2023): This order explicitly prohibited the operational use by U.S. Government departments and agencies of commercial spyware that poses significant security risks or has been misused by foreign actors to enable human rights abuses.
• Key Risk Factors: Factors indicating such risk included unauthorized access attempts against U.S. Government devices or use by foreign actors against activists to curb dissent.

Another major entity in this market is Paragon Solutions, founded in Israel in 2019. Paragon’s flagship spyware, Graphite, focuses specifically on breaking into encrypted messaging applications like WhatsApp, Signal, and iMessage without gaining control of the entire device.

The ICE Contract sparked renewed alarm. The Biden administration initially suspended a $2 million contract between U.S. Immigration and Customs Enforcement (ICE) and Paragon Solutions in October 2024. However, the contract was reactivated around September 2025 by the Trump administration. This reactivation occurred after Paragon’s shares were transferred to Paragon Parent Inc., a U.S. company, thereby technically complying with the executive order’s requirement that providers be U.S.-based. Critics warned that ICE's access to such invasive cyber-weapons, especially given its "troubling track record," poses a profound threat to civil liberties and privacy within the U.S..

Defense and Mitigation Against Spyware

Since mobile devices often lack the strong security defenses of traditional endpoints, they are viewed as "low-hanging fruit" by threat actors employing spyware. Organizations must establish strong safeguards.

Organizational Safeguards:

1. Mobile Threat Defense (MTD) Solutions: Implement MTD solutions that provide continuous, real-time, on-device threat detection.
2. Supplement MDM: MTD solutions supplement Mobile Device Management (MDM) by also using Mobile App Vetting (MAV) capabilities to evaluate applications for privacy and security risks.

Individual User Security Steps:

• Update Devices: It is strongly recommended to update devices to the latest operating systems, such as updating to iOS 14.8, which patched the ForcedEntry vulnerability.
• Limit Communication: Concerned users may block iMessages from unknown senders, or adopt the more drastic measure of completely disabling the iMessage function.
• Physical and Network Security: Users should limit physical access to their phones and avoid public WiFi services unless using a VPN.
• Disappearing Messages: Use disappearing messages in end-to-end encrypted apps.
• Frequent Resets: Frequent phone resets may temporarily remove non-persistent malware.

---

Sources

• Analyzing Pegasus Spyware's Zero-Click iPhone Exploit ForcedEntry | Trend Micro (US)
• Complete Guide to Mobile Spyware Defense - Zimperium
• FACT SHEET: President Biden Signs Executive Order to Prohibit U.S. Government Use of Commercial Spyware that Poses Risks to National Security | The White House
• ICE Cyber Mercenaries | Electronic Frontier Foundation
• ICE Reactivates Contract With Israeli-linked Spyware Firm Paragon - The New American
• ICE Restores Spyware Deal With Paragon Solutions After US Takeover - Evrim Ağacı
• Transcript of the video "ICE reactivation of spyware contract raises alarm about next steps" uploaded on the YouTube channel "MSNBC"
• Ice obtains access to Israeli-made spyware that can hack phones and encrypted apps - The Guardian
• Pegasus (spyware) - Wikipedia
• Pegasus spyware and its implications on human rights (Council of Europe report)
• Virtue or Vice? A First Look at Paragon's Proliferating Spyware Operations - The Citizen Lab