Devil's Tongue.
An Israeli firm's spyware reads your encrypted Signal messages, signs into your own accounts, and can post as you. Set it beside everything else this sector sells, and a darker question appears — one we pose, carefully, and do not answer for you.
Microsoft and the University of Toronto's Citizen Lab named this malware in 2021. Every capability on this page is separately documented by them and by later researchers. What we do here is the uncomfortable part: we lay the capabilities next to each other and ask what they add up to — while holding a hard line between what is proven and what is merely, now, possible.
What this page is about
In July 2021, Microsoft's threat-intelligence team and Citizen Lab jointly exposed an Israeli “private-sector offensive actor” — the spyware firm Candiru — and the malware it sells, which Microsoft named DevilsTongue. It is not a theory: Microsoft found more than 100 victims, built defenses, and published the analysis. The malware breaks into Windows machines through zero-day exploits, reads files, steals passwords, and pulls messages out of encrypted apps including Signal. Most unsettling, it uses stolen credentials to sign into the victim's own accounts and can send messages as them.
That last capability is where this page does its real work. A tool that can post as you is, by definition, a tool that could put words in your mouth — and when you set it beside the rest of what this same ecosystem demonstrably sells (software that alters security-camera footage, platforms that shape what AI tells you, a pipeline that seeds the industry meant to catch all this), a serious question comes into focus. We pose that question. We do not assert it has been answered in anyone's specific case, because no such case is publicly confirmed. The discipline is the whole point: every brick here is a receipt, and the conclusion stays a question.
Books that go deeper on this story. Links are Amazon affiliate searches — buying through them supports the work at no cost to you.
The same investigation, restaged one beat at a time. Step through it here, or present it fullscreen.
Devil's Tongue.
An Israeli firm's spyware reads your encrypted Signal messages, signs into your own accounts, and can post as you. Stacked with the rest of this ecosystem, it forces a darker question — one we pose, carefully, and fence hard.
What the tool actually does
Devil's Tongue is real — Microsoft and Citizen Lab named it in 2021.
FACTThis is documented, not alleged. In July 2021 the Microsoft Threat Intelligence Center, working with Citizen Lab at the University of Toronto, exposed an Israel-based 'private-sector offensive actor' it codenamed SOURGUM — which Citizen Lab identified with high confidence as the spyware firm Candiru — and the malware Microsoft named DevilsTongue. Microsoft identified more than 100 victims worldwide, including politicians, human rights activists, journalists, academics, embassy workers, and dissidents, and shipped protections. The malware is a complex, modular Windows implant installed via zero-day exploits, with browser exploits served through single-use links on messaging apps like WhatsApp.
It reads your encrypted messages — including Signal.
FACTEncryption is not a shield once the device itself is owned. DevilsTongue exfiltrates files and browser data and is built to pull messages out of encrypted applications, including the Signal Desktop app — a capability documented in leaked Candiru project material analyzed by Recorded Future's Insikt Group in 2025, and consistent with Microsoft's original analysis. The point is simple and chilling: 'end-to-end encrypted' protects a message in transit between devices; it does nothing once spyware is reading the screen on one end.
It can become you — sign into your own accounts and send messages as you.
FACTThis is the capability that changes the stakes, and it is Microsoft's own finding. DevilsTongue harvests the victim's stored credentials and session cookies and uses them to sign directly into the victim's own accounts — Facebook, Twitter, Gmail, and other services — to read their data and, on some of those services, send messages as the victim. We grade the capability FACT, exactly as Microsoft described it. What an operator chooses to do with the ability to post as someone else is a separate question — which is the next claim.
A tool that can post as you is a tool that could frame you — the risk, not a proven event.
SOME SMOKEHere is the fence, held deliberately. If an operator can silently sign into your accounts and send messages as you, then the same access can plant a message, a post, or a file that looks like it came from you — a fabricated record that would be very hard to disprove. That is the serious risk the capability creates, and it is why researchers treat account-takeover spyware as categorically more dangerous than passive snooping. But we have no publicly confirmed case of DevilsTongue being used to frame a specific person, and we do not assert one. We grade this SOME SMOKE: the capability is documented FACT; the use to fabricate evidence is a real, posed danger, raised as a question, not a finding.
About half the known victims were Palestinian — the 'laboratory' isn't a metaphor here.
FACTMicrosoft's own victim map is the citation. Of the 100-plus DevilsTongue victims Microsoft identified, approximately half were located in the Palestinian Authority, with the rest in Israel, Iran, Lebanon, Yemen, Spain (Catalonia), the UK, Turkey, Armenia, and Singapore. Microsoft notes that a victim's location doesn't prove which government agency is the customer, since targeting crosses borders — we carry that caveat. But the concentration is documented, and it grounds the 'field-tested on Palestinians' argument in a specific, verifiable finding rather than a slogan. See The Palestine Laboratory for the broader pattern.
Blacklisted by Washington in 2021 — then pulled back in for the Gaza war.
FACTCandiru was placed on the US Commerce Department's Entity List in 2021 for trafficking in tools used against officials, journalists, activists, and academics. That blacklisting did not end its usefulness to its home state. In October 2023, Bloomberg reported that Israel's security services pulled blacklisted spyware firms — including NSO Group, the maker of Pegasus, and Candiru — back 'into the fold,' asking them to upgrade their tools to help track hostages and Hamas in Gaza. The firms Washington sanctioned were, in the government that hosts them, rehabilitated by the war. We grade the blacklisting and the Bloomberg-reported recall FACT.
What happens when you stack the capabilities
Here is the uncomfortable exercise, done honestly. Each item below is a separate, documented capability — most of them already a FACT-graded page on this site. No single one is speculation. The question is only what they look like set side by side.
- Get in, unseen. Zero-click infection through ordinary online ads (The Advertising Weapon), and through a single link on a messaging app (DevilsTongue, above).
- Read everything. Files, passwords, and the contents of encrypted apps including Signal (above).
- Become the target. Sign into their own accounts and send messages as them (above) — the ability to put words in someone's mouth.
- Alter the record itself. Software sold to governments to add, delete, or change what a security camera recorded (Toka) — the ability to edit the physical trail.
- Shape what people believe. A paid operation to manipulate what AI assistants and search results say (The Foreign Agent).
- Sit inside the watchmen. Alumni of the military signals-intelligence unit seeded the US cybersecurity industry (Unit 8200), and a firm run by its veterans is now embedded in US immigration enforcement (Paragon).
- Practice on a captive population. Roughly half of DevilsTongue's known victims were Palestinian (above); the broader pattern is The Palestine Laboratory.
Now the question. Put item 3 next to item 4 — the power to post as you and the power to edit the camera footage — and both halves of a fabricated case against a chosen person demonstrably exist in a single state's mercenary-cyber ecosystem: one tool to manufacture the digital trail, another to manufacture the video one. So the question is not rhetorical and it is not paranoid. It is: if an actor can enter your device unseen, impersonate you, read your encrypted messages, and alter the record of where you were and what you did — what, exactly, still stops a manufactured and “undeniable” case against anyone they choose? On the documented record, the honest answer is uncomfortable: mostly just whether they decide to.
- Capability is not proof of use. Everything above is a documented capability. We have no publicly confirmed case of these tools being combined to frame a specific person, and we assert none. We pose the question the capabilities force; the verdict stays open.
- This is not a people, and it is not a cabal. The subjects are named companies, a named military unit, and their documented products. “They secretly control everything” is the antisemitic canard; it is false and we reject it. The strength of this page is the opposite of a conspiracy theory — every brick is a citation.
- Oversight is the real story. The danger isn't a cinematic plot; it's that tools this powerful operate with this little accountability, sold by firms a key ally blacklisted and the host state brought back. The fix is scrutiny, not a scapegoat.
The end of “pics or it didn't happen”
For most of modern life, a message in your name, a login from your account, or footage from a camera functioned as proof. This is the Israeli Influence story at its sharpest and most unsettling: a documented toolkit that erodes exactly those proofs — the ability to speak as you, to read what you thought was private, and, in a sibling product, to change what the camera saw. It is also a Surveillance State(s) story and a Who Controls What You Get to Know story, because a world where the record can be authored is a world where whoever holds the tools decides what is true.
None of that requires a grand plot to be alarming. It requires only that the tools exist, that they are sold for money to whichever government pays, and that the oversight meant to constrain them is thin enough that a blacklisted vendor can be sanctioned by one government and recalled by another in the same few years. That is the documented situation. The scary question isn't our invention — it's what the receipts, laid end to end, force any honest reader to ask.
Questions worth taking seriously
Isn't this just a conspiracy theory dressed up?
It's the opposite, by construction. A conspiracy theory asserts a hidden plot and works backward to fit the facts. We do the reverse: every capability here is separately documented by Microsoft, Citizen Lab, Recorded Future, or Bloomberg, and we refuse to claim the one thing that isn't proven — that these tools have been combined to frame a specific person. We pose that as a question the capabilities force, and we name and reject the “they control everything” canard explicitly. The discipline is the credibility.
Has anyone actually been framed with Devil's Tongue?
There is no publicly confirmed case, and we don't claim one. What's documented is the capability: Microsoft found that the malware can sign into victims' accounts and send messages as them. Fabricating evidence is the recognized danger that capability creates — which is why account-takeover spyware is treated as categorically worse than passive surveillance — but “could” is not “did.” We grade the capability FACT and the framing use SOME SMOKE, posed as a risk. If a confirmed case ever surfaces, the grade changes; until then, we hold the line.
If you are named on this page
If you are named on this page, or are a party materially affected by the claims made here, and you wish to respond, correct the record, or add context, use the Contact page. Responses are published verbatim alongside the original claim, with the sender identified and the date of receipt. The channel stays open for the life of the page.
This site aggregates and grades a record that other outlets and primary sources have already put on the record. Every FACT-graded claim above is sourced to court filings, government reports, sworn whistleblower disclosures, published investigative journalism, or named-source statements. The citations are the accountability mechanism; this section is how you get on the record too.
The record
- Microsoft (MSTIC) — Protecting customers from a private-sector offensive actor using 0-day exploits and DevilsTongue malware
- The Citizen Lab — Hooking Candiru: Another Mercenary Spyware Vendor Comes into Focus
- Recorded Future (Insikt Group) — Tracking Candiru's DevilsTongue Spyware in Multiple Countries
- Bloomberg — Israel Taps Blacklisted Pegasus Maker to Track Hostages in Gaza