Dossier mode
Devil's Tongue
The same investigation, restaged one beat at a time. Drive it with the arrow keys, space, or autoplay. Nothing is cut from the piece — long runs are split across frames. Read the full investigation or open the Israeli Influence on the United States hub.
Devil's Tongue.
An Israeli firm's spyware reads your encrypted Signal messages, signs into your own accounts, and can post as you. Stacked with the rest of this ecosystem, it forces a darker question — one we pose, carefully, and fence hard.
Candiru's DevilsTongue malware — exposed by Microsoft and Citizen Lab in 2021 — breaks into Windows machines, reads encrypted messages including Signal, and uses stolen credentials to sign into and post from the victim's own accounts. Set beside software that alters camera footage and operations that shape what AI tells you, the documented capabilities add up to a fabrication toolkit.
Every capability graded FACT off Microsoft/Citizen Lab/Recorded Future/Bloomberg; the use of those capabilities to frame a specific person graded SOME SMOKE — posed as a documented risk, with no confirmed case, and the cabal canard named and rejected.
Devil's Tongue is real — Microsoft and Citizen Lab named it in 2021.
In July 2021 Microsoft's Threat Intelligence Center, with Citizen Lab, exposed an Israel-based 'private-sector offensive actor' codenamed SOURGUM — identified as the spyware firm Candiru — and its malware, DevilsTongue. Microsoft found 100+ victims (politicians, human rights activists, journalists, academics, embassy workers, dissidents) and shipped protections. It is a modular Windows implant installed via zero-day exploits, delivered through single-use links on apps like WhatsApp.
It reads your encrypted messages — including Signal.
DevilsTongue exfiltrates files and browser data and is built to pull messages out of encrypted apps including Signal Desktop — documented in leaked Candiru project material analyzed by Recorded Future's Insikt Group (2025) and consistent with Microsoft's analysis. End-to-end encryption protects a message in transit; it does nothing once spyware reads the screen on one end.
It can become you — sign into your accounts and send messages as you.
Microsoft's own finding: DevilsTongue harvests stored credentials and session cookies and uses them to sign directly into the victim's accounts (Facebook, Twitter, Gmail, and others), read their data, and on some services send messages as the victim. The capability to post as someone else is documented FACT; what an operator does with it is the next question.
A tool that can post as you could frame you — the risk, not a proven event.
If an operator can sign into your accounts and send messages as you, the same access can plant a message, post, or file that looks like yours — a fabricated record hard to disprove. That is why account-takeover spyware is treated as categorically more dangerous than passive snooping. But there is no publicly confirmed case of DevilsTongue framing a specific person, and we assert none. The capability is FACT; the use to fabricate evidence is a posed risk, SOME SMOKE, raised as a question.
About half the known victims were Palestinian — the 'laboratory' isn't a metaphor here.
Of the 100+ DevilsTongue victims Microsoft identified, approximately half were in the Palestinian Authority, the rest spread across Israel, Iran, Lebanon, Yemen, Spain (Catalonia), the UK, Turkey, Armenia, and Singapore. Microsoft cautions that a victim's location doesn't prove which agency is the customer — carried — but the concentration is documented, grounding the 'field-tested on Palestinians' argument in Microsoft's own victim data.
Blacklisted by Washington in 2021 — then pulled back in for the Gaza war.
Candiru was placed on the US Commerce Entity List in 2021 for tools used against officials, journalists, activists, and academics. In October 2023, Bloomberg reported that Israel's security services pulled blacklisted firms — NSO (maker of Pegasus) and Candiru — back 'into the fold,' asking them to upgrade their tools to track hostages and Hamas in Gaza. The firms Washington sanctioned were rehabilitated by the war in the state that hosts them.
The scary question — and the line we hold.
- The stack (each separately documented): get in unseen (ads + messaging); read everything incl. Signal; become you (post as the victim); alter the record (Toka edits camera footage); shape belief (manipulate AI/search); sit inside the watchmen (Unit 8200 alumni, Paragon in US immigration); practice on a captive population (~half the victims Palestinian).
- The question posed: if an actor can enter your device unseen, impersonate you, read your encrypted messages, and alter the record of where you were — what stops a manufactured, 'undeniable' case against anyone they choose? On the documented record, mostly just whether they decide to.
- FENCE 1 — capability is not proof of use: no publicly confirmed case of these tools combined to frame a specific person; we pose the question, we don't assert the verdict.
- FENCE 2 — not a people, not a cabal: subjects are named companies (Candiru, NSO), a named military unit, and their products; 'they control everything' is the antisemitic canard, false, rejected. Every brick is a citation.
- FENCE 3 — the real story is oversight: tools this powerful operate with this little accountability — blacklisted by one government, recalled by another within a few years.
Why it matters.
For most of modern life a message in your name, a login from your account, or footage from a camera functioned as proof. This is the Israeli Influence story at its sharpest: a documented toolkit that erodes exactly those proofs — the ability to speak as you, read what you thought was private, and, in a sibling product, change what the camera saw. A world where the record can be authored is a world where whoever holds the tools decides what is true. It needs no grand plot to be alarming — only that the tools exist, are sold to whoever pays, and face oversight thin enough that a blacklisted vendor is sanctioned by one government and recalled by another in the same few years.
Help us fill these lines.
- OpenAny forensically confirmed case of account-takeover spyware used to fabricate evidence against a specific person — the event that would move the framing claim from SOME SMOKE to a finding.
- OpenThe current operator/customer list for DevilsTongue since Recorded Future's 2025 infrastructure tracking, and which governments run it.
- OpenWhat the post-blacklist recall of NSO/Candiru for Gaza produced, and whether US export-control enforcement responded.