Italian prosecutors investigating a domestic spying scandal say they have independently confirmed that two immigration activists and a journalist were hacked at the same time in late 2024, suggesting all three were part of the same “infection campaign”.
The development could bring more questions for the far-right government of Giorgia Meloni, who has denied any involvement in the hacking of the journalist, the Fanpage editor-in-chief, Francesco Cancellato.
The controversy over the hacking claims erupted in early 2025, when WhatsApp revealed it had discovered that 90 people, including journalists and members of civil society, had been targeted by hacking software made by Paragon Solutions, a spyware maker founded in Israel but which is now owned by US investors.
Like other spyware makers, Paragon sells use of its spyware, known as Graphite, to government agencies, who are supposed to use it to fight and prevent crime. It can hack into any phone, without users knowing their mobiles have in effect been taken over. Paragon has previously confirmed it cancelled its contract with the Italian government after reports first emerged that Cancellato had been targeted.
Cancellato, whose online investigative news outlet has published critical reporting about Meloni’s Brothers of Italy party, including an exposé of young fascists in the party’s youth organisation, was the first person in Italy to come forward publicly.
More victims emerged, including Giuseppe Caccia and Luca Casarini, two pro-immigrant activists. A subsequent investigation by the Italian parliamentary committee for security (Copasir) found that Italian intelligence agencies had legally targeted Caccia and Casarini, but said they had not found evidence that Cancellato had been targeted.
The findings this week by prosecutors in Rome and Naples – independent investigative bodies – marks a major departure from the previous parliamentary report, because it confirms that Cancellato was hacked. It also deepens the mystery of who targeted him, and why.
In a joint statement on Thursday the prosecutors said: “Among all the mobile phones acquired by the numerous plaintiffs, traces of activity attributable to malware were found exclusively on three Android devices,” and that the “presumed period of compromise of the devices used by Casarini, Caccia and Cancellato” dated back to the early hours of 14 December 2024.
“The serial execution of three attacks on the same night suggests that they may have been part of a single infection campaign,” the statement said, adding that while the investigation could not find evidence that the secret services had also spied on Cancellato, it would continue to work towards identifying the perpetrators.
The scandal has contributed to a decline in press freedom in Italy, with the country’s ranking in the World Press Freedom Index sliding from 41st place in 2023 to 49th in 2025.
During her yearly press conference in early January, Meloni became defensive when Cancellato asked her what role her administration had played in the spying. She said it was “offering its support” to “get to the truth”, before casting herself as a victim, saying: “My life has ended up in the newspapers.”
Cancellato said on Friday that the prosecutors’ report was “a small, important step towards the truth”.
“It’s not much, but now I know for certain that on December 14, 2024, something really did happen on my phone, someone really did get in and steal my messages,” he added. “Now, without rushing or forcing interpretations, we need to figure out who did it … and once again, I ask politicians, the government and parliament to help me figure out who did it and to join me in calling for clarity on this matter.”
Paragon has said it sells its spyware only to democratic countries and that its terms of service forbid agencies to use the technology against journalists or members of civil society.
Other individuals have also said they received notifications that they had been targeted, including more pro-immigrant activists. It is unclear whether their cases were reviewed by the prosecutors.
John Scott-Railton, a senior researcher at the Citizen Lab at the University of Toronto, which investigates digital threats against civil society, said the prosecutors’ findings were an important vindication of WhatsApp’s decision to alert users that they had been targeted.
“Cancellato’s case has been massively inconvenient both to the Italian government and to Paragon Solutions, because it’s about a journalist getting hacked with Paragon’s ‘ethical’ spyware. Today’s announcement makes it impossible to dismiss, and immediately raises serious questions about why no confirmation was surfaced in prior official investigations by the Italian authorities. This urgently warrants further investigation,” he said.
