Loading malware…
Pegasus is commercial mobile spyware developed by the Israeli company NSO Group and marketed to government intelligence and law-enforcement customers. It compromises iOS and Android devices to conduct covert surveillance, including accessing messages and calls, monitoring communications from end-to-end-encrypted applications on compromised endpoints, tracking device location, and remotely activating microphones and cameras. Documented targets include journalists, human rights defenders, anti-corruption advocates, academics, political opposition figures, and other members of civil society.
Pegasus has been delivered through personalized SMS messages containing exploit links, zero-click attacks against messaging and other mobile services, and network-injection techniques. Link-based delivery infrastructure identifies a visiting handset and selects an appropriate exploit. Documented exploitation includes FORCEDENTRY, associated with CVE-2021-30860, against iMessage and CVE-2019-2215 against the Android Binder driver. Other Pegasus infection chains have targeted HomeKit, Find My, and iMessage without requiring user interaction.
Pegasus employs anti-forensic techniques to hinder detection and investigation. An analyzed Android Pegasus/Chrysaor variant uses reflection and string obfuscation to complicate static analysis and contains native functionality for screen capture and process injection. NSO Group has also maintained anonymized operational infrastructure and attack accounts intended to obscure connections to the company and its customers. Individual surveillance operations cannot necessarily be attributed to a specific government solely from identifying Pegasus on a device.
10 CVEs Mallory has correlated with this family across public research and vendor advisories. Each card links to the full Mallory page for that vulnerability.
14 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
CVE-2019-2215 is a use-after-free in the Android Binder driver ... This was exploited in the wild by NSO Group’s Pegasus spyware.
Poland’s Central Anti-Corruption Bureau (CBA) — which ran the spyware program — “did not have full control over the Pegasus system” that NSO Group operated.
Amnesty documented that Moroccan authorities deployed NSO Group's Pegasus spyware against civil-society figures from 2017 to 2021, using one-click phishing and zero-click compromise vectors.
Pegasus (NSO Group) : Infection confirmée sur l’iPhone d’un militant étudiant ; indicateurs d’infection à haute confiance entre décembre 2025 et janvier 2026, via un exploit zero-click iMessage.
Pegasus is discussed as spyware allegedly used by Saudi Arabia, Bahrain, the United Arab Emirates, and Rwanda to target dissidents, journalists, and opposition figures in the United Kingdom.
Pegasus is discussed as spyware allegedly used by Saudi Arabia, Bahrain, the United Arab Emirates, and Rwanda to target dissidents, journalists, and opposition figures in the United Kingdom.
+8 more in the app. View in Mallory
17 distinct techniques documented for this family, organized by ATT&CK tactic.
If chained with a browser renderer exploit, this bug could fully compromise a device through a malicious website.
„Нашата анализа потврди дека е искористена zero-click експлоатација преку iMessage за да се инфицира уредот со шпионскиот софтвер Pegasus на NSO Group“
Level 10 involves a government partnering with or coercing a service provider to provide information; examples include providers assisting state-run data collection from mobile-phone networks.
„Се проценува дека zero-click експлоатацијата користена во нападот го таргетирала Apple iMessage“
Amnesty documented the use of sophisticated attack vectors, ranging from “one-click” phishing links requiring user interaction to advanced “zero-click” exploits.
Amnesty documented ... advanced “zero-click” exploits capable of compromising devices without any action from the target.
Cette fonctionnalité de sécurité bloque la plupart des pièces jointes aux messages et des aperçus de liens... N’ouvrez pas les liens ni les pièces jointes contenus dans les e-mails ou les SMS provenant d’expéditeurs inconnus.
CVE-2019-2215, which is a use-after-free in Binder in the Android kernel. The bug is a local privilege escalation vulnerability that allows for a full compromise of a vulnerable device.
The government deployed ... Pegasus spyware to target civil society figures both domestically and abroad in what Amnesty described as “unlawful surveillance attacks.”
The category is intended to identify hacking techniques authorized for real-time communications interception.
“their personal data was accessed and stolen.”
The government deployed ... Pegasus spyware to target civil society figures both domestically and abroad in what Amnesty described as “unlawful surveillance attacks.”
“Spyware is noted for its ability to access everything on a device, record screens or take over its microphone.”
Pegasus "has the ability to covertly enable the phone’s microphone and camera."
Pegasus "has the ability to covertly enable the phone’s microphone and camera."
The category is intended to identify hacking techniques authorized for real-time communications interception.
The agent constructs the following URL that contains the C2 server, which can be extracted from the initial configuration or a command sent via SMS... The malware adds “SessionId1” and “SessionId2” to the HTTP headers... The HTTP response should be an XML file containing at least the following fields: “response”, “code”, and “message”. | 1. HTTP Communication... The agent constructs the following URL that contains the C2 server... The malware creates an XmlSerializer object that will be encrypted using the AES algorithm and then sent to a C2 server via HTTP.
Moroccan intelligence agents utilized a private intermediary firm to contract with NSO Group ... This arrangement was designed to shield the state from leaving a paper trail directly linking it to NSO Group or the spyware.
Officials discussed whether and how the technology could support criminal investigations, and a May 2021 document proposed guidelines for possible use while referencing specific criminal matters where personnel believed the tool might apply.
399 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
200 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.