A Turkish spyware story ages five days, then acquires Greece and Israel on the way

The origin item appears to be Middle East Eye’s “Suspected spyware attacks target Turkish ministers' phones,” published roughly 8 September, which reported that three ministers were affected and that Ankara replaced the handsets. Turkish Minute picked it up on 9 September under a headline that contained the word “report” — an accurate signal that it was relaying MEE rather than confirming independently — and Türkiye Today carried a version the same day. Also on 9 September, Greek City Times ran the story under the headline “Greece and Israel Named in Suspected Turkey Spyware Attack.” That framing, not the incident, is what kept moving. Zamin.uz, an Uzbek aggregator, published an English-language version on 11 September; Greek News On Demand re-posted the “Greece and Israel Named” construction on 12 September in English and Greek, the Greek version carrying an editorialising line in the headline itself.

What has not been established anywhere The Files could verify is the load-bearing part. Apple’s threat notifications, when the company issues them, name no vendor and no state; any attribution to a particular government is therefore someone’s interpretation, and the chain above does not make clear whose. No forensic examination by Citizen Lab, Amnesty International’s Security Lab or any other third party has been reported. No commercial spyware vendor has been named. The three ministers have not been identified on the record in the material reviewed, and no on-the-record Turkish government statement has surfaced — only “according to a report.” Citizen Lab’s most recent substantive publication remains “Bad Connection,” dated 8 May 2026 and concerned with telecom-layer surveillance rather than handset implants.

Assessment: This is the standard laundering cycle, visible in its entirety because the timestamps survived. A hedged claim enters circulation, a partisan outlet supplies the missing defendant, aggregators strip the hedge because hedges do not travel, and by day four the attribution is being repeated as though it were the reported fact rather than a headline someone wrote. The tell is that no new information entered the chain after 9 September. Readers should treat any sentence naming Greece or Israel in this matter as unattributed until someone produces either a Turkish official on the record or a forensic report. Until then it is an allegation about an allegation.