Loading story…
Investigations into NSO Group’s Pegasus spyware showed the platform was used by government customers to target journalists, human rights defenders, political opponents, lawyers, diplomats, and other civil society figures. The Pegasus Project reported a leaked list of more than 50,000 phone numbers allegedly selected by NSO clients, including nearly 200 journalists across multiple countries, while reporting in India said current and former military and security officials also appeared in the data as potential surveillance targets, indicating the spyware’s reach extended into sensitive national security circles. In response to malicious cyber activity tied to such tools, the U.S. Department of Commerce added NSO Group and other foreign firms to the Entity List.
Subsequent technical research from Citizen Lab found that NSO customers continued deploying Pegasus in 2022 through three iPhone zero-click exploit chains—LATENTIMAGE, FINDMYPWN, and PWNYOURHOME—against targets including Mexican human rights defenders working on cases involving the military and the Ayotzinapa investigation. The broader spyware market also drew attention to other vendors, including Italy’s Cy4Gate, which was reported to market interception, intelligence analysis, and smartphone spyware products such as Epeius to government customers in Italy and abroad, underscoring continuing concerns that commercial surveillance capabilities remain available despite repeated abuse scandals and export-control pressure.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
26 events from the most recent confirmed update back to the earliest known activity.
Citizen Lab shared additional PWNYOURHOME forensic artifacts with Apple in January 2023.
Citizen Lab reported that PWNYOURHOME began deployment in October 2022 against iOS 15 and iOS 16 devices, using HomeKit and iMessage in a two-step zero-click chain.
Citizen Lab shared forensic artifacts related to the 2022 Pegasus exploit chains with Apple in October 2022.
Citizen Lab reported a further Pegasus activity date on María Luisa Aguilar Rodríguez’s device later in September 2022.
Citizen Lab reported Pegasus spyware was active on María Luisa Aguilar Rodríguez’s device in late September 2022.
Citizen Lab reported a second date on which Pegasus spyware was active on Jorge Santiago Aguirre Espinosa’s device.
Citizen Lab reported that María Luisa Aguilar Rodríguez was infected with Pegasus spyware during June 2022.
Citizen Lab reported Pegasus spyware was active on Jorge Santiago Aguirre Espinosa’s device during a FINDMYPWN-linked infection.
Citizen Lab reported that FINDMYPWN began deployment in June 2022 as a two-step zero-click exploit chain targeting iOS 15 devices via Find My and iMessage.
Citizen Lab identified LATENTIMAGE as a distinct iOS 15 zero-click Pegasus exploit chain used in January 2022.
The U.S. Department of Commerce announced that it added NSO Group and other foreign companies to the Entity List for malicious cyber activities.
The Wire reported that several current or former Indian military and security officials appeared in the leaked Pegasus Project database as probable surveillance targets, while noting that forensic examination was not available to confirm infection.
Forbidden Stories, Amnesty International, and more than 80 journalists from 17 media organizations published the Pegasus Project investigation based on leaked data containing more than 50,000 phone numbers allegedly selected by NSO Group clients.
Cy4Gate attended ISS World Middle East and Africa and planned presentations on Gens.AI and real-time fusion of surveillance data from multiple active and passive sensors.
Cy4Gate said in a 10 February 2021 press release that the Naples case involved malfunctions that were promptly identified and analyzed.
Motherboard reported that a fake Italian-language WhatsApp page appeared to be used to install a module capable of deploying Cy4Gate’s Epeius spyware.
In a December 2020 interview, former Cy4Gate CEO Eugenio Santagata said the company conducts offensive cyber intelligence activities under judicial and government authorization as ethical hacking.
Cy4Gate signed an agreement with SIO S.p.A. granting SIO exclusive use of Epeius for Italian prosecutors’ offices. Cy4Gate estimated the deal could open access to about 70 new prosecutors’ offices and roughly 70% of the police interception market.
The Central Administrative Tribunal dismissed Jitendra Kumar Ojha’s appeal against his premature retirement.
Colonel Amit Kumar filed a petition in the Supreme Court on behalf of 356 Army personnel over apprehended dilution of AFSPA protections. The Wire says he was later selected for potential surveillance around the same period as Colonel Mukul Dev.
K.K. Sharma attended an RSS-affiliated conference in Kolkata while serving as BSF chief. The Wire says his phone numbers were added to the leaked Pegasus database about a month later.
Jitendra Kumar Ojha challenged his premature retirement before the Central Administrative Tribunal. The article says he and his wife were selected as persons of interest around the time of this legal challenge.
Retired RAW official Jitendra Kumar Ojha was prematurely retired from service, preceding later legal action and reported surveillance interest around his case.
Citizen Lab said it had previously reported in 2017 that Centro PRODH members, including Jorge Santiago Aguirre Espinosa, were targeted with Pegasus in 2016.
Cy4Gate was founded in 2014 as a joint venture between Elettronica Group and Expert System.
After Citizen Lab’s disclosures, Apple released security improvements to HomeKit in iOS 16.3.1.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
5 references tracked. Mallory keeps watching after this page renders.
citizenlab.ca
Open sourceirpimedia.irpi.eu
Open sourcecommerce.gov
Open sourcethewire.in
Open sourceforbiddenstories.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Investigations by **Forbidden Stories**, **Amnesty International**, Citizen Lab and major news outlets found that NSO Group’s **Pegasus** spyware was repeatedly used far beyond stated counterterrorism and criminal investigations, with targets including journalists, human rights lawyers, anti-corruption activists, diplomats, aid workers, and political exiles. A leaked dataset of more than **50,000 phone numbers** linked to NSO customers and forensic analysis of examined devices showed confirmed or attempted infections on dozens of phones, including successful compromises of **Apple iPhones**. Reporting tied selections and infections to multiple governments and highlighted targeting of figures around the **Dalai Lama**, overseas numbers used by Americans, and civil society members across countries including Mexico, India, Hungary, Morocco and France. Mexico emerged as one of the clearest examples of abuse, where Pegasus-linked phishing messages and other surveillance tactics were used against prominent reporters, lawyers and activists investigating corruption, human rights abuses and politically sensitive cases. Separate reporting alleged that weak oversight and corruption allowed spyware bought by Mexican authorities to be misused and, in some cases, to reach actors connected to drug cartels, deepening risks for journalists and investigators. NSO denied that the leaked list represented Pegasus targets and said it sells only to vetted governments, but the disclosures prompted warnings about national security risks to U.S. personnel abroad and renewed calls, including from Edward Snowden, for a global crackdown on the commercial spyware trade.
Aug 14, 2026
A leaked dataset reviewed by the Pegasus Project linked NSO Group’s **Pegasus** spyware to the selection of more than **50,000 phone numbers** by government clients, including journalists, lawyers, activists, and political figures across multiple countries. Amnesty International’s Security Lab examined dozens of devices and found **23 confirmed infections** and **14 attempted compromises**, while Citizen Lab validated parts of the forensic work. Reporting tied suspected targeting to at least 10 governments, with prominent cases involving more than 40 Indian journalists, Moroccan and French reporters including **Edwy Plenel**, and Mexican journalist **Cecilio Pineda Birto**, whose number was reportedly selected shortly before his murder. Further forensic investigations expanded the pattern beyond journalists to civil society groups, including six Palestinian human rights defenders whose iPhones were confirmed hacked in 2020 and 2021. Amnesty also published indicators of compromise and a technical methodology through its GitHub repository and **Mobile Verification Toolkit**, documenting Pegasus infrastructure, suspicious processes, and artifacts associated with zero-click exploitation of Apple services such as **iMessage**. NSO Group denied that the leaked list was a roster of Pegasus targets and disputed the scale of abuse, but the combined reporting and device analysis showed repeated use of the spyware against people outside legitimate criminal or terrorism investigations.
Aug 15, 2026
New reporting and technical analysis have added to scrutiny of **NSO Group’s Pegasus spyware**, linking the platform to alleged state surveillance abuses and exposing more of the company’s operational model. OCCRP reported that a former Moroccan intelligence officer said Morocco’s domestic intelligence service, the **DGST**, used intermediary firm **FSSYS Maroc** to help procure and manage Pegasus while preserving plausible deniability, with a second former intelligence source corroborating the arrangement and researchers pointing to close UAE-Morocco security ties. Separate reporting also said NSO co-founder **Shalev Hulio** traveled to Panama in 2013 using an Israeli diplomatic passport, a detail cited in records connected to a Panamanian illegal wiretapping investigation involving the interception of communications from politicians, journalists, judges, diplomats, and business figures. At the same time, Amnesty International’s Security Lab published a detailed technical study based on internal NSO documents disclosed in U.S. litigation, describing Pegasus as a government-sold surveillance platform with per-customer infrastructure, a dedicated **White Services** support unit, and a **Pegasus Anonymizing Transmission Network (PATN)**. The analysis outlined infection paths across **Android** and **iOS** including **WhatsApp**, **iMessage**, Voice-over-WiFi, Apple Photos, network injection, physical access, and short-range radio methods, and said NSO’s client-specific infrastructure can enable forensic attribution when the same attacker account appears across victims. Citizen Lab separately highlighted that Pegasus was also used against former MEP **Stelios Kouloglou** while he served on the European Parliament’s **PEGA** committee, raising concerns that confidential committee material may have been exposed.
Jul 28, 2026