Google 2025 Zero-Day Report: Commercial Spyware Leads Attributed Exploits, Windows Risks Explained

The headline statistic, stated carefully​

Google's Threat Intelligence Group (GTIG) reported that 90 zero-day vulnerabilities were exploited in the wild in 2025. That compares with 78 in 2024 and 100 the year before. GTIG defines a zero-day as a flaw that is exploited maliciously before a public patch exists. It also says its dataset only reflects detected and disclosed cases. Its cutoff was December 31, 2025, and the numbers may shift as old incidents come to light.

Attribution is where the story gets interesting, and where retellings drift. GTIG attributed 42 of the 90 to a threat actor, and commercial surveillance vendors (CSVs) took the lead for the first time. Reports disagree on the CSV count: some say 15, others say 18. The difference is confirmed versus likely attribution.

• Of the 42, 15 were exploited by CSVs and another three by "likely CSVs."
• 12 were exploited by state-sponsored espionage groups, with another three "likely" state-linked.
• Nine were exploited by financially motivated criminals.

So "15 of 42" and "18 of 42" are both defensible, but they describe different categories. Neither means vendors were behind most of the 90 zero-days. Fewer than half of the 90 were attributed at all.

Google's own wording is also careful. It says a growing proportion of zero-day exploitation is conducted by CSVs and/or their customers. A vendor's role and a customer's role are not the same thing. In Google's 2024 description of the industry, governments who buy spyware select targets, craft campaigns and monitor the implant.

Why this belongs on a Windows site​

Most headline commercial spyware, such as Pegasus, Predator and Graphite, targets phones. Google's report says CSVs primarily targeted mobile devices and browsers. Windows still appears in the picture in several ways:

• Microsoft leads the zero-day count. Of the 90 zero-days GTIG tracked in 2025, 25 were in Microsoft products, 11 in Google products and eight in Apple products. That count covers all actors, not just spyware vendors.
• Operating systems were the most exploited category. Google reports that OSs, desktop and mobile, accounted for 44% (39) of all zero-days in 2025. Desktop OS zero-days have stayed between 16 and 23 a year.
• Chrome on Windows has been a target. Google's spotlight section describes CVE-2025-2783, a Chrome sandbox flaw on Windows, where an attacker could abuse handle handling in inter-process messages to escape the sandbox. Google does not tie that specific bug to a named vendor in the passage reviewed here.
• Enterprise technology is the biggest share. 43 of the zero-days hit enterprise software and appliances, 48% of the total. That is a record, but it is driven largely by state-backed groups attacking edge devices. Google's spyware-vendor findings stress mobile and browser exploitation.

The Windows spyware example: Candiru's DevilsTongue​

The best-documented Windows commercial spyware is Candiru's, which Microsoft calls Devil's Tongue. Citizen Lab analysed a sample recovered from a politically active individual in Western Europe. It said the Windows payload appears to include features for exfiltrating files, exporting messages saved in Signal Desktop, and stealing cookies and passwords from Chrome, Internet Explorer, Firefox, Safari and Opera. Citizen Lab was still analysing the code at the time, so that list describes apparent functionality.

Later Citizen Lab work notes that Microsoft's analysis found the spyware could let an operator use a victim's cloud accounts on the infected device to send or post messages. Citizen Lab warned that this could be used to plant evidence.

Citizen Lab's analysis of a leaked Candiru proposal also shows how these tools are sold. That proposal is the source of the pricing detail in ForkLog's piece. The €16 million proposal allows unlimited infection attempts but monitoring of only 10 devices at once. Extra capacity cost more: €1.5M bought 15 more simultaneous devices plus one more country. Capturing Signal data was sold as an add-on. A remote shell was an optional extra at €1.5M.

For an admin, the point is that a successful intrusion of this kind is a full compromise of the endpoint. It can reach browser credentials, messaging data and cloud sessions.

How the vendors operate​

Google describes these products as more than a malware file. CSVs sell pay-to-play tools that bundle an exploit chain, the spyware, and the infrastructure needed to collect data. The supply chain involves exploit developers, brokers, vendors and government customers.

Amnesty's December 2025 analysis of leaked Intellexa material shows how that can look in practice. It described a system called Aladdin designed to silently infect phones just by viewing a malicious ad. Amnesty also found evidence that Intellexa could, in certain cases, remotely access its customers' spyware systems after deployment. That matters legally, because vendors usually claim they do not operate the tools.

Documented abuse​

ForkLog lists many cases. The ones below have primary-source backing:

• Serbia. Amnesty found that two BIRN journalists were targeted with Pegasus in February 2025. The lure was a link sent over Viber. Amnesty concluded there was a strong likelihood that Serbian state actors were involved. NSO Group replied that it could not comment on specific customers and said it is closely regulated by export control authorities.
• Italy and Paragon. Citizen Lab confirmed with high confidence that an iPhone running iOS 18.2.1 belonging to a European journalist was compromised with Paragon's Graphite. The attack used an iMessage zero-click exploit that Apple fixed in iOS 18.3.1 as CVE-2025-43200. Italian officials acknowledged using Graphite against two other individuals, but said they could not determine who targeted the third, the Fanpage.it editor Francesco Cancellato.
• Spain. Citizen Lab's CatalanGate work found at least 65 people targeted or infected with Pegasus or Candiru spyware. It did not conclusively attribute the targeting to a government, but said circumstantial evidence points strongly to Spain.

What to treat with caution​

Some of ForkLog's figures were not corroborated by the primary sources reviewed. Treat them as reported claims rather than verified facts:

• Market-size estimates and contract prices other than Candiru's leaked proposal.
• Details of the Candiru asset sale and rebranding as Integrity Labs.
• The size of the NSO damages award, which should be checked against the court record.
• The number of countries that signed the Pall Mall code. Signatory lists change.

The Pall Mall Process is a UK–France initiative that has produced a voluntary code of practice for states. The UK government calls it non-binding. Critics argue that without enforcement it will not constrain the market.

Practical takeaways for IT teams​

This is not an everyday threat for most organisations. These tools are expensive and aimed at high-risk individuals. Still, the defensive advice Google gives is sound for any Windows estate:

1. Patch quickly. Google says all 2025 zero-days in its dataset now have patches. Delay is what leaves an organisation exposed.
2. Segment and use least privilege. Google says systems should be designed with segmentation and least-privilege access.
3. Keep a real-time asset inventory. You cannot defend or patch what you do not know you own.
4. Monitor for anomalies. Google notes that monitoring is not preventative, but it is a way to detect and act against threats as they occur.
5. Treat spyware warnings seriously. Citizen Lab advises journalists and civil-society members who get warnings from Apple, Meta, Google or others to seek expert help through groups such as Access Now.

None of this guarantees protection against a well-funded targeted operation. It does shrink the window in which exploits work.

Bottom line​

The ForkLog piece is right that commercial spyware has moved to the front of attributed zero-day exploitation. The accurate version is narrower. Vendors and their customers led attributed exploitation in Google's data, with 15 confirmed and 18 including likely cases. That is out of 42 attributed cases, which is under half of the 90 total. Mobile and browser exploitation remains their focus. The Windows-specific risk is real but narrower, and Candiru's DevilsTongue is the best-documented example.