A Jan 2025 incident, addressed since Feb 2025, is still a concern now due to the non-transparent disclosure and other factors.

A critical security flaw, identified as CVE-2025-43200, in Apple’s Messages app, had been exploited to deploy Paragon’s Graphite spyware targeting journalists, according to a report by The Hacker News on 13 June, 2025.

The Citizen Lab, a research group focused on cyber surveillance, uncovered evidence of the flaw being used against Italian journalist Ciro Pellegrino and another prominent European journalist in January and February 2025, using devices running iOS 18.2.1.

The attacks, described as highly sophisticated, enabled covert surveillance by accessing messages, cameras, microphones, and location data without victims’ awareness. When exploited, the zero click vulnerability required no user interaction to gain control, and allowed attackers to compromise devices by processing maliciously crafted photos or videos shared via iCloud Links.

The response by Apple was to notify affected users and issue threat alerts, although the firm had initially delayed disclosing the flaw’s existence, raising questions about transparency. Eventually, this zero-click vulnerability was addressed with software patches* on 10 February 2025. Apple’s response included patching another zero-day flaw, CVE-2025-24200, in the same updates, addressing vulnerabilities exploited in targeted attacks.

While the incident had occurred in the early part of 2025, concerns linger over the spyware linked to Paragon, a commercial surveillance vendor, about mercenary spyware targeting civil society members such as journalists and activists.

The Citizen Lab has noted that the infections contacted a server associated with an unidentified Paragon operator, consistent with previous reports of Graphite spyware targeting Italian human rights activists. This incident underscores the growing threat of zero-click exploits, which bypass user interaction and traditional security measures.

Even now, in June 2025, users and potential victims of such zero click vulnerabilities are urged to update to the latest software versions and consider enabling Lockdown Mode to reduce exposure to such threats.

*with updates across multiple platforms, including iOS 18.3.1, iPadOS 18.3.1, macOS Sequoia 15.3.1, and others, to implement enhanced validation checks