Loading story…
Investigations and legal filings described a growing mercenary spyware market in which private vendors developed and sold intrusion capabilities to government customers, with NSO Group emerging as the best-known example but not the only one. Reporting tied NSO’s Pegasus spyware to attacks on activists, journalists, and government personnel, including the targeting of UAE activist Ahmed Mansoor and more than 1,400 devices via a WhatsApp exploit that reportedly required no answer from the victim. Microsoft, Google, Cisco, GitHub, LinkedIn, VMware, and others backed WhatsApp’s lawsuit against NSO, arguing the company should not receive sovereign immunity for operating as a private offensive cyber actor, while broader reporting said Facebook had identified seven spyware firms targeting roughly 50,000 people across its platforms.
Separate investigations showed the industry stretching beyond NSO into Europe and Asia. Lighthouse Reports linked Italy’s RCS Lab and its Tykelab unit to covert mobile-phone tracking through telecom signaling weaknesses and to Hermit spyware infrastructure, while Citizen Lab and Motherboard connected a fake WhatsApp phishing campaign to Italian vendor Cy4Gate and its Epeius lawful-intercept product. Earlier reporting on Hacking Team and allegations about APT17 selling stolen data underscored how surveillance and intrusion capabilities have been commercialized, repackaged, and marketed across borders, despite repeated scandals, lawsuits, and sanctions aimed at curbing abuse.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
17 events from the most recent confirmed update back to the earliest known activity.
An investigation alleged that Rome-based Tykelab, part of RCS Lab, had conducted large-scale covert mobile-phone tracking worldwide by exploiting telecom signaling vulnerabilities and sending tens of thousands of tracking packets through dozens of networks.
Takeover disclosures made to shareholders revealed that Tykelab was part of RCS Lab, a relationship the investigation said had remained undisclosed until December.
Reuters reported that U.S. State Department officials had been hacked using Pegasus, marking a significant allegation that the spyware had affected American government personnel.
The United States imposed sanctions on NSO Group, escalating official pressure on the spyware vendor after years of abuse allegations.
Citizen Lab and Motherboard uncovered an iPhone phishing campaign impersonating WhatsApp and tied its infrastructure to Italian surveillance vendor Cy4Gate, including domains, certificates, and an Epeius-branded login portal.
New reports in mid-2021 alleged abuse of NSO Group's Pegasus spyware involving Western government contexts, broadening scrutiny beyond earlier cases centered on authoritarian misuse.
Microsoft, joined by Cisco, GitHub, Google, LinkedIn, VMware, and the Internet Association, filed an amicus brief opposing NSO Group's attempt to claim sovereign immunity in the WhatsApp litigation.
Citizen Lab and later reporting said the United Arab Emirates targeted human rights activist Ahmed Mansoor using NSO Group's Pegasus spyware. The case became an early high-profile example of Pegasus being used against a dissident.
Researchers later found fake domains attributed to RCS Lab that were purchased as early as 2015, suggesting the company may have been running mobile hacking infrastructure for years.
Hacking Team was hacked in 2015, and the leaked internal emails later exposed dealings including the failed Grenada procurement attempt. The breach also contributed to the company's later loss of business and export ability.
The Italian firm Hacking Team became a major public example of the hacker-for-hire industry, amid accusations that it sold untraceable spyware to dozens of countries without regard for human rights or privacy abuses.
Leaked Hacking Team documents described an October 31, 2013 letter presenting Jan Marsalek as a Grenada representative interested in Hacking Team's smartphone interception platform, followed by a reported November 27 meeting in Milan. Subsequent reporting said the letter was fraudulent and the deal never went through.
Apple filed suit against NSO Group, adding to the legal pressure already created by Facebook's litigation over Pegasus-related abuse allegations.
Facebook reported that seven hacker-for-hire firms had targeted about 50,000 people on its platforms, identifying four Israeli companies as well as firms from China, India, and North Macedonia.
Citizen Lab reporting cited by Microsoft said Pegasus was used between July and August of that year to hack 36 phones belonging to Al Jazeera journalists, producers, anchors, and executives.
Intrusion Truth alleged that APT17 not only hacked Western targets but also circulated a price list within China's hacking community offering stolen data for sale, including information from Chinese victims.
WhatsApp brought a legal case against NSO Group alleging Pegasus was used via WhatsApp to compromise more than 1,400 mobile devices, including those of journalists and human rights defenders.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
8 references tracked. Mallory keeps watching after this page renders.
lighthousereports.nl
Open sourcetechnologyreview.com
Open sourcetechnologyreview.com
Open sourcevice.com
Open sourceblogs.microsoft.com
Open sourcevice.com
Open sourceintrusiontruth.wordpress.com
Open sourcecitizenlab.ca
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Investigations into **NSO Group’s Pegasus spyware** showed the platform was used by government customers to target journalists, human rights defenders, political opponents, lawyers, diplomats, and other civil society figures. The Pegasus Project reported a leaked list of more than 50,000 phone numbers allegedly selected by NSO clients, including nearly 200 journalists across multiple countries, while reporting in India said current and former military and security officials also appeared in the data as potential surveillance targets, indicating the spyware’s reach extended into sensitive national security circles. In response to malicious cyber activity tied to such tools, the U.S. Department of Commerce added NSO Group and other foreign firms to the **Entity List**. Subsequent technical research from **Citizen Lab** found that NSO customers continued deploying Pegasus in 2022 through three iPhone zero-click exploit chains—`LATENTIMAGE`, `FINDMYPWN`, and `PWNYOURHOME`—against targets including Mexican human rights defenders working on cases involving the military and the Ayotzinapa investigation. The broader spyware market also drew attention to other vendors, including Italy’s **Cy4Gate**, which was reported to market interception, intelligence analysis, and smartphone spyware products such as `Epeius` to government customers in Italy and abroad, underscoring continuing concerns that commercial surveillance capabilities remain available despite repeated abuse scandals and export-control pressure.
Aug 15, 2026
New reporting and technical analysis have added to scrutiny of **NSO Group’s Pegasus spyware**, linking the platform to alleged state surveillance abuses and exposing more of the company’s operational model. OCCRP reported that a former Moroccan intelligence officer said Morocco’s domestic intelligence service, the **DGST**, used intermediary firm **FSSYS Maroc** to help procure and manage Pegasus while preserving plausible deniability, with a second former intelligence source corroborating the arrangement and researchers pointing to close UAE-Morocco security ties. Separate reporting also said NSO co-founder **Shalev Hulio** traveled to Panama in 2013 using an Israeli diplomatic passport, a detail cited in records connected to a Panamanian illegal wiretapping investigation involving the interception of communications from politicians, journalists, judges, diplomats, and business figures. At the same time, Amnesty International’s Security Lab published a detailed technical study based on internal NSO documents disclosed in U.S. litigation, describing Pegasus as a government-sold surveillance platform with per-customer infrastructure, a dedicated **White Services** support unit, and a **Pegasus Anonymizing Transmission Network (PATN)**. The analysis outlined infection paths across **Android** and **iOS** including **WhatsApp**, **iMessage**, Voice-over-WiFi, Apple Photos, network injection, physical access, and short-range radio methods, and said NSO’s client-specific infrastructure can enable forensic attribution when the same attacker account appears across victims. Citizen Lab separately highlighted that Pegasus was also used against former MEP **Stelios Kouloglou** while he served on the European Parliament’s **PEGA** committee, raising concerns that confidential committee material may have been exposed.
Jul 28, 2026
Multiple reports indicate that mercenary spyware operations have begun targeting not only traditional victims such as journalists and activists, but also the developers and security researchers who build and analyze surveillance tools. Apple issued high-confidence threat notifications to iOS exploit developers, warning them of government spyware targeting their devices. This marks a notable escalation in the mercenary spyware ecosystem, as attackers are now focusing on individuals with deep technical knowledge and access to sensitive information about exploit development. The commercial spyware market continues to thrive, with unpatched vulnerabilities fueling rapid innovation and deployment of new attack techniques. Security researchers have documented a record number of zero-day vulnerabilities exploited in the wild, many linked to commercial surveillance vendors. The targeting of exploit developers suggests a coordinated campaign within the cybersecurity community, highlighting the growing risks faced by those at the forefront of digital defense and offensive tool creation.
Jul 12, 2026