Loading story…
A leaked dataset reviewed by the Pegasus Project linked NSO Group’s Pegasus spyware to the selection of more than 50,000 phone numbers by government clients, including journalists, lawyers, activists, and political figures across multiple countries. Amnesty International’s Security Lab examined dozens of devices and found 23 confirmed infections and 14 attempted compromises, while Citizen Lab validated parts of the forensic work. Reporting tied suspected targeting to at least 10 governments, with prominent cases involving more than 40 Indian journalists, Moroccan and French reporters including Edwy Plenel, and Mexican journalist Cecilio Pineda Birto, whose number was reportedly selected shortly before his murder.
Further forensic investigations expanded the pattern beyond journalists to civil society groups, including six Palestinian human rights defenders whose iPhones were confirmed hacked in 2020 and 2021. Amnesty also published indicators of compromise and a technical methodology through its GitHub repository and Mobile Verification Toolkit, documenting Pegasus infrastructure, suspicious processes, and artifacts associated with zero-click exploitation of Apple services such as iMessage. NSO Group denied that the leaked list was a roster of Pegasus targets and disputed the scale of abuse, but the combined reporting and device analysis showed repeated use of the spyware against people outside legitimate criminal or terrorism investigations.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
33 events from the most recent confirmed update back to the earliest known activity.
A joint technical report independently confirmed Front Line Defenders' findings that six Palestinian human rights defenders' iPhones were hacked with Pegasus in 2020 and 2021.
Citizen Lab notes that several organizations employing the named victims were designated as terrorist organizations by the Israeli government in October 2021, after the Pegasus compromises had already occurred.
Citizen Lab says Front Line Defenders began collecting data in October 2021 regarding suspected hacking of devices belonging to Palestinians working for West Bank civil society organizations.
Threatpost reported expert reactions to the Pegasus disclosures, highlighting the use of a zero-click iMessage exploit and calls for stronger accountability for NSO Group and platform vendors.
After Amnesty International reported Pegasus infections on fully patched iPhones running iOS 14.6 via zero-click iMessage exploits, Apple said it was investigating the findings. Apple security head Ivan Krstić described the attacks as highly sophisticated, costly, short-lived, and used against specific individuals.
The Guardian published findings that Cecilio Pineda Birto's phone number had been selected by a Mexican NSO client around the time of threats and his killing, though his missing phone prevented forensic confirmation.
AmnestyTech published a repository of Pegasus indicators of compromise, including domains, process names, suspicious files, and a STIX file, alongside references to its technical methodology and Mobile Verification Toolkit.
Le Monde and Forbidden Stories reported that a Moroccan security service or an NSO client appearing to be the Moroccan government selected numerous journalists, including Moroccan and French reporters, as Pegasus targets.
The Wire reported that more than 40 Indian journalists appeared in the leaked data and Amnesty's forensic examinations found attempted or successful Pegasus activity on multiple devices, including confirmed compromises of several journalists' phones.
The Pegasus Project reported that a leaked dataset containing more than 50,000 phone numbers selected since 2016 pointed to widespread abuse of NSO Group's Pegasus by government clients. Forbidden Stories and Amnesty International had obtained the data and shared it with a consortium of media outlets.
Forbidden Stories reports that Soulaimane Raissouni was sentenced to five years in prison in July 2021.
The Wire reports that M.K. Venu's phone was infected with Pegasus as recently as June 2021 through a zero-click iMessage exploit.
Amnesty reported that Sushant Singh's phone was compromised from March 2021 to July 2021 through a zero-click exploit in Apple iMessage.
Citizen Lab found that T6's phone logs showed Pegasus-linked binaries and a process named accountpfd beginning on 2020-11-04.
Citizen Lab reported that Ghassan Halaika's phone showed a Pegasus-linked binary and the process name smmsgingd beginning on 2020-07-14.
Amnesty's forensic appendix documented repeated Pegasus-related traces on Azerbaijani journalist Khadija Ismayilova's device from 2019 to 2021. It specifically recorded visits on 2020-07-10 and 2020-07-13 to opposedarrangement[.]net URLs associated with Pegasus infrastructure.
Forbidden Stories reports that Soulaimane Raissouni, successor to Taoufik Bouachrine, was arrested in May 2020 on sexual assault charges.
Le Monde states that Amnesty International revealed in 2020 that Moroccan investigative journalist Omar Radi's phone had been infected with Pegasus.
Forbidden Stories says Edwy Plenel attended a two-day conference in Essaouira, Morocco, in June 2019, where he gave interviews about human rights violations by the Moroccan state.
Amnesty International's Security Lab found that Edwy Plenel's phone was compromised in the summer of 2019 after his return to Paris, and Citizen Lab peer-reviewed the analysis.
Amnesty International said forensic analysis showed Pegasus was successfully installed on Hatice Cengiz's phone four days after Jamal Khashoggi was murdered in Istanbul. The Pegasus Project also reported targeting of other Khashoggi family members before and after the killing.
Amnesty reported that Paranjoy Guha Thakurta's phone was compromised during parts of April, May, June, and July 2018, providing forensic evidence of Pegasus activity.
Amnesty's forensic analysis found Siddharth Varadarajan's phone was compromised during parts of April 2018 after his number appeared in the leaked data.
Amnesty International's Security Lab forensically confirmed that Syed Abdul Rahman Geelani's iPhone was compromised by Pegasus between February 2018 and January 2019, with additional infections from September 2019 to October 2019. The analysis found evidence including at least one zero-click iMessage exploit.
Forbidden Stories reports that Akhbar al-Youm editor Taoufik Bouachrine was arrested on charges including human trafficking, sexual assault, rape, prostitution, and harassment.
The Wire says Sushant Singh appeared on the leaked list in mid-2018 while working on reporting related to the Rafale aircraft deal, linking his selection to politically sensitive journalism.
Cecilio Pineda Birto was shot dead in Ciudad Altamirano, Guerrero, after receiving threats and publicly accusing police and politicians of collusion with Los Tequileros. His phone disappeared from the scene, preventing forensic examination.
The Guardian reports that a few weeks after an October 2016 meeting with Mexico's federal protection mechanism, Cecilio Pineda Birto's phone number was selected as a possible surveillance target by an NSO client.
Threatpost states that Pegasus was initially discovered by Lookout and Citizen Lab in 2016, marking the earliest explicit event anchor in the references.
The repository history shows that on January 26, 2024, Amnesty rebuilt the Pegasus STIX file with new indicators, added an email address user tied to a zero-click attack, and added a new Pegasus process identified by Reporters Without Borders.
The AmnestyTech repository history records that a new domain and process were added to the Pegasus indicators repository on July 14, 2022.
The repository history states that an indicator previously added in error was removed on July 29, 2021.
The AmnestyTech repository history notes that a file creating a false positive was removed on July 28, 2021.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
14 references tracked. Mallory keeps watching after this page renders.
forbiddenstories.org
Open sourcecitizenlab.ca
Open sourcetheguardian.com
Open sourcethreatpost.com
Open sourcethewire.in
Open sourcethewire.in
Open sourcegithub.com
Open sourcelemonde.fr
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Investigations by **Forbidden Stories**, **Amnesty International**, Citizen Lab and major news outlets found that NSO Group’s **Pegasus** spyware was repeatedly used far beyond stated counterterrorism and criminal investigations, with targets including journalists, human rights lawyers, anti-corruption activists, diplomats, aid workers, and political exiles. A leaked dataset of more than **50,000 phone numbers** linked to NSO customers and forensic analysis of examined devices showed confirmed or attempted infections on dozens of phones, including successful compromises of **Apple iPhones**. Reporting tied selections and infections to multiple governments and highlighted targeting of figures around the **Dalai Lama**, overseas numbers used by Americans, and civil society members across countries including Mexico, India, Hungary, Morocco and France. Mexico emerged as one of the clearest examples of abuse, where Pegasus-linked phishing messages and other surveillance tactics were used against prominent reporters, lawyers and activists investigating corruption, human rights abuses and politically sensitive cases. Separate reporting alleged that weak oversight and corruption allowed spyware bought by Mexican authorities to be misused and, in some cases, to reach actors connected to drug cartels, deepening risks for journalists and investigators. NSO denied that the leaked list represented Pegasus targets and said it sells only to vetted governments, but the disclosures prompted warnings about national security risks to U.S. personnel abroad and renewed calls, including from Edward Snowden, for a global crackdown on the commercial spyware trade.
Aug 14, 2026
Investigations into **NSO Group’s Pegasus spyware** showed the platform was used by government customers to target journalists, human rights defenders, political opponents, lawyers, diplomats, and other civil society figures. The Pegasus Project reported a leaked list of more than 50,000 phone numbers allegedly selected by NSO clients, including nearly 200 journalists across multiple countries, while reporting in India said current and former military and security officials also appeared in the data as potential surveillance targets, indicating the spyware’s reach extended into sensitive national security circles. In response to malicious cyber activity tied to such tools, the U.S. Department of Commerce added NSO Group and other foreign firms to the **Entity List**. Subsequent technical research from **Citizen Lab** found that NSO customers continued deploying Pegasus in 2022 through three iPhone zero-click exploit chains—`LATENTIMAGE`, `FINDMYPWN`, and `PWNYOURHOME`—against targets including Mexican human rights defenders working on cases involving the military and the Ayotzinapa investigation. The broader spyware market also drew attention to other vendors, including Italy’s **Cy4Gate**, which was reported to market interception, intelligence analysis, and smartphone spyware products such as `Epeius` to government customers in Italy and abroad, underscoring continuing concerns that commercial surveillance capabilities remain available despite repeated abuse scandals and export-control pressure.
Aug 15, 2026
Citizen Lab documented multiple Pegasus infections against civil society targets, including New York Times journalist Ben Hubbard and four Jordanian human rights defenders, lawyers, and journalists. Hubbard’s iPhone was reportedly infected twice through zero-click iMessage exploit chains tied to `KISMET` and `FORCEDENTRY`, after earlier SMS and WhatsApp lure attempts linked to a Saudi-associated operator. In Jordan, researchers found repeated Pegasus targeting between 2019 and 2021 and assessed that two operators, `MANSAF` and `BLACKIRIS`, were likely connected to Jordanian government agencies; one successful iPhone compromise occurred even after Apple sued NSO Group and began notifying victims. Technical reporting and forensic guidance showed Pegasus was built for covert, persistent surveillance across mobile platforms. Google previously identified the Android variant `Chrysaor` on a small number of devices, describing capabilities including privilege escalation, persistence, keylogging, screenshot capture, data theft, and covert microphone use. Reverse-engineering of Pegasus for Android detailed command-and-control over HTTP with encrypted values, SMS-based command execution disguised as verification texts, exfiltration of messages, contacts, call logs, emails, and app data, plus live audio recording, screenshot capture, camera access, and self-deletion features; Amnesty International separately published forensic methodology to help investigators detect Pegasus infections.
Aug 15, 2026