Prabowo Widodo
In early 2025, the digital security landscape was once again shaken as WhatsApp issued notifications to approximately 90 users, many of them prominent journalists and civil society members across Europe, informing them they had been targeted by sophisticated spyware developed by the Israeli firm Paragon Solutions. This incident was swiftly followed by Apple sending its own threat notifications to a new cohort of iOS users. Subsequent forensic analysis conclusively confirmed that at least two of these individuals, both journalists, had been compromised by Paragon’s "Graphite" spyware through a "zero-click" attack. This insidious method allows attackers to infiltrate a device without any user interaction, such as tapping a malicious link, underscoring the escalating sophistication and stealth of contemporary digital espionage. These events are not anomalies but rather stark illustrations of a systemic and increasingly normalized threat facing high-risk individuals globally.
For over 15 years, a dedicated community of security researchers, non-governmental organizations, and technology companies has meticulously documented countless instances where government-backed hackers have successfully targeted and compromised the digital devices of journalists, human rights defenders, political dissidents, and critics worldwide. This relentless assault on digital privacy and security transcends geographical boundaries and political ideologies, manifesting as a pervasive challenge to fundamental freedoms and democratic principles.
The Evolving Threat Landscape: Sophistication and Stealth
The attacks rely on a new generation of expensive, highly sophisticated, and stealthy tools. These advanced spyware solutions allow their operators to illicitly gain access to and install malicious software on target computers and, critically, smartphones. Modern smartphones, serving as repositories for virtually every facet of an individual’s daily life—from personal communications and photographs to location history and financial data—represent an invaluable target for surveillance.
Upon successful deployment, spyware grants its operators virtually unfettered access to the target’s device and all its data. This level of compromise enables government spies to perform a myriad of intrusive actions: recording phone calls in real-time, exfiltrating encrypted chat messages, stealing private photos and documents, and remotely activating the device’s camera and microphone to capture ambient sounds and record nearby conversations without the owner’s knowledge. Furthermore, sophisticated spyware typically includes robust capabilities for real-time location tracking, creating a comprehensive digital footprint of the target’s movements and interactions. The "zero-click" capability, in particular, represents a significant escalation, eliminating the need for social engineering and making detection exponentially more difficult for the average user.
A History of Digital Espionage: From Targeted Hacks to Global Scrutiny
The revelation of Paragon Solutions’ activities in 2025 follows a well-established, troubling chronology of state-sponsored spyware deployment. The most notorious example remains the Pegasus spyware, developed by NSO Group, another Israeli firm. In 2021, the "Pegasus Project," a collaborative investigation by a consortium of journalistic organizations, revealed that Pegasus had been used to target the phones of thousands of individuals globally, including heads of state, human rights activists, lawyers, and journalists. This investigation brought the shadowy world of commercial spyware into the mainstream, exposing the complicity of governments in deploying these tools against their own citizens and international figures.
Prior to Pegasus, other companies like Hacking Team and FinFisher had faced scrutiny for selling surveillance tools to authoritarian regimes. WhatsApp itself has been a frequent battleground; in 2019, the platform famously sued NSO Group after discovering a hacking campaign that exploited a vulnerability to install Pegasus on approximately 1,200 users’ devices. These incidents highlight a disturbing trend: the commodification of highly invasive surveillance technology, making it accessible to a broader range of state actors, often with minimal oversight or accountability. The 2025 attacks attributed to Paragon Solutions are a continuation of this pattern, demonstrating that despite increased public awareness and legal challenges, the industry continues to thrive and innovate.
The Spyware Industry: A Global Concern and Ethical Quandary
The commercial spyware industry, estimated to be worth billions of dollars annually, operates largely in the shadows, supplying powerful digital weapons to governments worldwide. These tools are often marketed under the guise of national security and crime-fighting, but their documented misuse against civil society consistently raises profound ethical and human rights concerns. The ability to purchase and deploy such potent surveillance capabilities fundamentally shifts the balance of power between states and their citizens, enabling unprecedented levels of monitoring and potentially stifling dissent.
The existence of a thriving market for zero-day exploits—software vulnerabilities unknown to the developer that can be exploited for malicious purposes—further fuels this industry. As noted in past reports, exploits targeting widely used applications like WhatsApp can fetch millions of dollars, creating a powerful economic incentive for discovering and weaponizing critical flaws. This continuous arms race between exploit developers and software vendors underscores the perpetual challenge of securing digital platforms.
Tech Giants Respond: Bolstering User Defenses
In response to this escalating and pervasive threat, leading technology companies have intensified their efforts to provide users with more robust defenses. Recognizing the unique vulnerabilities faced by at-risk individuals, Apple, Google, and Meta (WhatsApp’s parent company) have developed and rolled out opt-in security features specifically engineered to counter targeted spyware attacks. These features represent a proactive stance, acknowledging that traditional security measures are often insufficient against state-level adversaries.
These advanced security features generally add an extra layer of protection, often by imposing stricter limitations or disabling certain less critical functionalities that could otherwise serve as attack vectors. While this might occasionally introduce minor inconveniences or alter the typical user experience, the consensus among cybersecurity experts and those who frequently face such threats is that the trade-off is well worth it. As many long-term users of these features can attest, any initial "wonkiness" or adjustments required are quickly adapted to, and the enhanced security provides invaluable peace of mind.
Representatives from these tech companies, alongside independent security researchers who have dedicated years to studying and combating spyware, and journalistic organizations like TechCrunch, strongly advocate for the adoption of these features. They recommend that anyone who suspects they might be a target of government surveillance—due to their profession, activism, or political affiliation—should enable them. Furthermore, even for individuals who do not believe they are direct targets, these advanced security settings offer a significantly elevated level of data protection against a broader spectrum of sophisticated threats, ensuring personal information remains more secure from falling into the wrong hands.
It is crucial to understand that no security measure is entirely foolproof. The digital security landscape is a dynamic battleground, characterized by a constant, iterative effort to identify and mitigate security flaws. Spyware developers continually seek out novel methods to hack into phones and services, while software makers, in turn, learn from these attacks, patch vulnerabilities, and develop new defenses. This "cat-and-mouse" game is perpetual. However, this inherent challenge does not diminish the value or effectiveness of these specialized security features. On the contrary, evidence strongly suggests that they have proven to be highly effective deterrents and protective mechanisms.
"These features are free, easy to enable, and represent the best defense we currently have against sophisticated spyware," affirmed Runa Sandvik, a respected security researcher with over a decade of experience in safeguarding journalists and other at-risk communities. Sandvik further emphasized the user-friendly nature of these tools: "If the features momentarily interfere with something you need to do, you can easily turn them off again – meaning the barrier to entry and experimentation is very low." Her statement underscores the accessibility and practical utility of these advanced protections.
Here’s a detailed overview of these critical security features and how to enable them:
Apple’s Lockdown Mode
Apple’s Lockdown Mode, introduced to its ecosystem in 2022, is available across all Apple devices, including iPhones, iPads, and Macs. Apple explicitly states that when Lockdown Mode is enabled, "your device won’t function like it typically does," indicating a conscious design choice to prioritize security over certain conveniences. This mode significantly hardens the device’s defenses by limiting various functionalities that are commonly exploited by advanced spyware.
Crucially, there is compelling evidence validating Lockdown Mode’s efficacy. Citizen Lab, a leading academic research center focusing on digital espionage, reported in 2023 that Lockdown Mode successfully thwarted a spyware attack carried out with NSO Group’s Pegasus software. As recently as March 2026, Apple itself confirmed that it has never detected a successful spyware attack on an Apple device with Lockdown Mode enabled, a testament to its robust design.
When activated, Lockdown Mode enacts several significant changes to your device:
- Messages: Most message attachment types, other than images, are blocked. Certain features, like link previews, are disabled. This significantly reduces the attack surface from malicious files or preview exploits.
- Web Browsing: Certain complex web technologies, like just-in-time (JIT) JavaScript compilation, are disabled by default unless a trusted site is explicitly excluded. This makes it harder for zero-click browser exploits to succeed.
- Apple Services: Incoming invitations for Apple services, such as FaceTime calls or shared albums, from new contacts are blocked unless the user has previously sent an invitation or request to that person.
- Wired Connections: Wired connections with a computer or accessory are blocked when the device is locked, preventing physical data extraction attempts.
- Configuration Profiles: Configuration profiles, which can be used to install malicious software, cannot be installed, and the device cannot enroll in Mobile Device Management (MDM).
- Incoming Calls: Incoming calls are blocked from unknown numbers if they are not already in the user’s contacts.
To switch on Lockdown Mode, navigate to Settings, then Privacy & Security, and scroll down to Lockdown Mode. After enabling the feature, your Apple device will restart to apply the heightened security protocols.
Personal experience from users, including journalists and activists, confirms that while some websites might initially appear "wonky" or certain features may be restricted, these are often minor adjustments. The ability to selectively switch off Lockdown Mode for specific trusted websites or applications without disabling the feature entirely provides a flexible balance between security and usability. Despite some initial "quirks," the enhanced protection quickly becomes a seamless part of the user experience.
Google’s Advanced Protection Program
Google launched its Advanced Protection Program (APP) in 2017, predating many of the public revelations about sophisticated spyware. This comprehensive program is specifically designed to fortify Google accounts against the most sophisticated and targeted attacks, including those perpetrated by state-sponsored actors. APP goes beyond standard two-factor authentication, implementing a suite of stringent security measures.
The Advanced Protection Program encompasses the following key features:
- Strongest 2-Step Verification: Requires the use of physical security keys (FIDO-compliant) or strong software passkeys for sign-in. This is highly resistant to phishing attacks, as it relies on a physical token or cryptographic proof of identity.
- Limited Third-Party App Access: Restricts access to your Google data for most third-party applications, permitting only trusted apps verified by Google to connect. This prevents malicious apps from gaining unauthorized access to sensitive information.
- Enhanced Gmail and Drive Scans: Provides deeper scanning for malware, viruses, and phishing attempts in Gmail and Google Drive, offering an additional layer of defense against malicious content.
- Rigorously Verified Account Recovery: Implements a more rigorous process for account recovery to prevent unauthorized access, even if an attacker has gained control of your phone or other recovery information.
- Automatic Threat Blocking: Proactively blocks access to known malicious sites or downloads, even if you accidentally click on a suspicious link.
- Restricted Account Creation: Limits the creation of new Google accounts from devices enrolled in APP, further hardening the ecosystem.
To enroll in the Advanced Protection Program, users must visit its official page and click "Get Started," which will prompt them to log into their Google account and follow the guided instructions. A crucial initial step involves adding a physical security key (such as a YubiKey or Titan Security Key) or a robust software passkey as the primary second factor for verification, moving beyond less secure methods like SMS codes. Users are also required to add a recovery phone and email, or utilize a backup passkey or security key, to ensure secure account recovery options.
Android’s Advanced Protection Mode
Introduced in 2025 and likely drawing inspiration from Apple’s successful Lockdown Mode, Android’s Advanced Protection Mode brings similar device-level defenses to Google’s widely used mobile operating system. This feature aims to harden Android devices against zero-click exploits and other advanced persistent threats (APTs) that characterize state-sponsored spyware.
Android’s Advanced Protection Mode provides the following security features:
- Restricted Communications: Limits inbound network connections, similar to Lockdown Mode, making it harder for remote exploits to compromise the device.
- Hardened Media Processing: Applies stricter sandboxing and validation to media files, which are often used as vectors for zero-click attacks.
- Memory Safe Language Adoption: Prioritizes the use of memory-safe programming languages in critical system components to reduce vulnerability to common exploit techniques.
- Sensor Access Restrictions: Requires explicit user consent for apps to access sensitive sensors like the camera or microphone, even if permissions were previously granted.
- Secure Boot and Verified Boot Enhancements: Strengthens the device’s boot process to ensure that only trusted software runs from startup.
- Disables Untrusted USB Accessories: Blocks connections to USB accessories unless the device is unlocked and the accessory is explicitly approved, preventing data exfiltration or malicious injection via USB.
- Limits API Exposure: Reduces the attack surface by limiting exposure of certain APIs and system services that are typically targeted by sophisticated exploits.
- Enhanced App Isolation: Further isolates applications from critical system processes and other apps, containing potential breaches.
To enable Advanced Protection Mode on your Android device, navigate to Settings, then Security & Privacy, and under Other Settings, tap Advanced Protection, then tap Device Protection to activate it. The exact path may vary slightly depending on the Android version and device manufacturer.
WhatsApp’s Strict Account Settings
WhatsApp, with over 3 billion users globally, is an indispensable communication tool, particularly for individuals in the crosshairs of resourceful government agencies. Its widespread adoption also makes it a prime target for sophisticated hacking operations. The demand for exploits that target WhatsApp is so high that zero-day vulnerabilities for the platform can command prices in the millions of dollars in the illicit market, reflecting their immense value to intelligence agencies.
The platform has been a frequent victim of such attacks. In 2019, WhatsApp famously identified and pursued legal action against NSO Group after detecting a campaign that targeted approximately 1,200 users. More recently, in early 2025, WhatsApp disclosed another sophisticated spy operation, which it disrupted, that had ensnared around 90 users, primarily journalists and civil society members in Europe, attributed to Paragon Solutions.
In response to these persistent threats, earlier in 2026, WhatsApp launched "Strict Account Settings," an opt-in feature designed to enhance privacy and security controls, tailoring its protections based on the operating system.
On both Android and iOS, Strict Account Settings activates the following features:
- Enhanced Link Previews: Disables or severely restricts link previews from unknown senders, preventing potential zero-click exploits embedded within preview generation.
- Stricter Profile Picture Privacy: Automatically sets your profile picture visibility to "My Contacts" or "Nobody," preventing unknown parties from collecting identifying information.
- Limited Group Invites: Automatically sets group invite permissions to "My Contacts," preventing you from being added to unwanted or potentially malicious groups by strangers.
- Call Privacy Enhancements: Offers options to silence calls from unknown numbers, reducing the risk of social engineering attacks or "missed call" zero-day exploits.
- Advanced Message Encryption Verification: Provides additional tools for verifying end-to-end encryption, ensuring that only the sender and intended recipient can read messages.
- Increased Account Security Prompts: Triggers more frequent security prompts and alerts for unusual account activity or login attempts.
- Blocking Unknown Contacts: Offers an easier and more prominent option to block and report unknown contacts, reducing unwanted interactions and potential threats.
To switch on this crucial feature, use your primary device and navigate to Settings, then Privacy, then scroll down to Advanced and toggle it on. This simple step can significantly fortify your WhatsApp account against highly targeted attacks.
The Ongoing Battle: A "Cat-and-Mouse" Game
The continuous development and deployment of these advanced security features by tech giants signify a critical shift in the approach to digital security. While the "cat-and-mouse" dynamic between attackers and defenders will inevitably persist, these specialized modes and programs offer a robust, accessible layer of protection that was previously unavailable. They demonstrate a recognition by major technology companies of their responsibility to protect users who are most vulnerable to state-level threats.
The implications of this ongoing digital arms race are far-reaching. The ability of governments to clandestinely monitor journalists, human rights defenders, and political opponents erodes press freedom, stifles dissent, and undermines the foundations of open societies. By providing stronger defenses, tech companies are empowering individuals to resist pervasive surveillance and continue their critical work.
Expert Recommendations and User Empowerment
The collective recommendation from cybersecurity experts, human rights organizations, and the tech community is unequivocal: if you believe you are at risk, enable these features. The minor trade-offs in convenience are far outweighed by the significant increase in digital security. These tools are designed to be user-friendly and can be adjusted as needed, making them practical for a wide range of users, not just those under immediate threat.
Beyond enabling these features, general best practices for digital hygiene remain paramount:
- Keep Software Updated: Regularly install operating system and app updates to patch known vulnerabilities.
- Strong, Unique Passwords: Use complex, unique passwords for all accounts, ideally managed with a reputable password manager.
- Two-Factor Authentication (2FA): Enable 2FA on all accounts, preferably using authenticator apps or security keys over SMS.
- Be Skeptical: Exercise caution with unsolicited messages, emails, or links, even if they appear to come from trusted sources.
Broader Implications and The Path Forward
The battle against state-sponsored spyware extends beyond technological defenses. It necessitates international cooperation, stricter export controls on surveillance technology, and greater accountability for governments and the companies that supply them with these potent tools. Organizations like Citizen Lab and Amnesty International continue to advocate for policy changes and legal challenges to curb the proliferation and misuse of spyware.
In conclusion, while the threat of sophisticated spyware remains a grim reality, the proactive development and deployment of advanced protection features by Apple, Google, and Meta offer a crucial shield. These tools empower users to significantly enhance their digital resilience, providing a vital layer of defense in an increasingly complex and hostile online environment. The ongoing commitment to innovation in security, combined with informed user choices, represents the most effective path forward in safeguarding digital rights and freedoms against the insidious reach of state-sponsored surveillance.
