Loading story…
NSO Group, the Israeli company known for developing the Pegasus spyware, has been acquired by a United States-based firm for a sum reported to be in the tens of millions of dollars. The acquisition marks a significant shift in the ownership of one of the world's most controversial surveillance technology companies. NSO Group has faced global scrutiny and legal challenges due to the use of its Pegasus spyware in targeting journalists, activists, and government officials. The new ownership is expected to bring changes to the company's operations, though details about the acquiring firm and its plans for NSO Group have not been fully disclosed. The deal comes at a time when the spyware industry is under increasing regulatory and public pressure, particularly in the United States and Europe. The acquisition has raised questions about the future direction of NSO Group and whether the new owners will implement stricter controls or transparency measures. Industry observers are watching closely to see if the change in ownership will affect ongoing legal cases and government investigations related to Pegasus. The purchase price, described as 'tens of millions,' is notable given NSO Group's previous valuation and the financial challenges it has faced due to blacklisting and reputational damage. The acquisition may also impact the broader market for surveillance tools, as NSO Group has been a major player in this space. Some experts speculate that the new owners may seek to rebrand the company or shift its business model to focus on more regulated markets. The deal has also prompted renewed debate about the ethical and legal implications of commercial spyware. Human rights organizations have called for continued vigilance and oversight, regardless of the company's new ownership. The acquisition underscores the ongoing demand for surveillance technology, even as governments and civil society push for greater accountability. It remains to be seen how the US firm's stewardship will influence NSO Group's relationships with government clients and its compliance with international law. The transaction is likely to have ripple effects throughout the cybersecurity and surveillance industries, as competitors and regulators respond to the news. Ultimately, the acquisition of NSO Group by a US firm represents a pivotal moment for the company and the global spyware market.
See the reporting duties and controls this puts on the clock.
3 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcewired.com
Open sourcesecurityonline.info
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Investigations into **NSO Group’s Pegasus spyware** showed the platform was used by government customers to target journalists, human rights defenders, political opponents, lawyers, diplomats, and other civil society figures. The Pegasus Project reported a leaked list of more than 50,000 phone numbers allegedly selected by NSO clients, including nearly 200 journalists across multiple countries, while reporting in India said current and former military and security officials also appeared in the data as potential surveillance targets, indicating the spyware’s reach extended into sensitive national security circles. In response to malicious cyber activity tied to such tools, the U.S. Department of Commerce added NSO Group and other foreign firms to the **Entity List**. Subsequent technical research from **Citizen Lab** found that NSO customers continued deploying Pegasus in 2022 through three iPhone zero-click exploit chains—`LATENTIMAGE`, `FINDMYPWN`, and `PWNYOURHOME`—against targets including Mexican human rights defenders working on cases involving the military and the Ayotzinapa investigation. The broader spyware market also drew attention to other vendors, including Italy’s **Cy4Gate**, which was reported to market interception, intelligence analysis, and smartphone spyware products such as `Epeius` to government customers in Italy and abroad, underscoring continuing concerns that commercial surveillance capabilities remain available despite repeated abuse scandals and export-control pressure.
Aug 15, 2026
New reporting and technical analysis have added to scrutiny of **NSO Group’s Pegasus spyware**, linking the platform to alleged state surveillance abuses and exposing more of the company’s operational model. OCCRP reported that a former Moroccan intelligence officer said Morocco’s domestic intelligence service, the **DGST**, used intermediary firm **FSSYS Maroc** to help procure and manage Pegasus while preserving plausible deniability, with a second former intelligence source corroborating the arrangement and researchers pointing to close UAE-Morocco security ties. Separate reporting also said NSO co-founder **Shalev Hulio** traveled to Panama in 2013 using an Israeli diplomatic passport, a detail cited in records connected to a Panamanian illegal wiretapping investigation involving the interception of communications from politicians, journalists, judges, diplomats, and business figures. At the same time, Amnesty International’s Security Lab published a detailed technical study based on internal NSO documents disclosed in U.S. litigation, describing Pegasus as a government-sold surveillance platform with per-customer infrastructure, a dedicated **White Services** support unit, and a **Pegasus Anonymizing Transmission Network (PATN)**. The analysis outlined infection paths across **Android** and **iOS** including **WhatsApp**, **iMessage**, Voice-over-WiFi, Apple Photos, network injection, physical access, and short-range radio methods, and said NSO’s client-specific infrastructure can enable forensic attribution when the same attacker account appears across victims. Citizen Lab separately highlighted that Pegasus was also used against former MEP **Stelios Kouloglou** while he served on the European Parliament’s **PEGA** committee, raising concerns that confidential committee material may have been exposed.
Jul 28, 2026
Investigations by **Forbidden Stories**, **Amnesty International**, Citizen Lab and major news outlets found that NSO Group’s **Pegasus** spyware was repeatedly used far beyond stated counterterrorism and criminal investigations, with targets including journalists, human rights lawyers, anti-corruption activists, diplomats, aid workers, and political exiles. A leaked dataset of more than **50,000 phone numbers** linked to NSO customers and forensic analysis of examined devices showed confirmed or attempted infections on dozens of phones, including successful compromises of **Apple iPhones**. Reporting tied selections and infections to multiple governments and highlighted targeting of figures around the **Dalai Lama**, overseas numbers used by Americans, and civil society members across countries including Mexico, India, Hungary, Morocco and France. Mexico emerged as one of the clearest examples of abuse, where Pegasus-linked phishing messages and other surveillance tactics were used against prominent reporters, lawyers and activists investigating corruption, human rights abuses and politically sensitive cases. Separate reporting alleged that weak oversight and corruption allowed spyware bought by Mexican authorities to be misused and, in some cases, to reach actors connected to drug cartels, deepening risks for journalists and investigators. NSO denied that the leaked list represented Pegasus targets and said it sells only to vetted governments, but the disclosures prompted warnings about national security risks to U.S. personnel abroad and renewed calls, including from Edward Snowden, for a global crackdown on the commercial spyware trade.
Aug 14, 2026