Loading story…
The UK Supreme Court ruled in Kingdom of Bahrain v. Shehabi and another that Bahrain cannot use state immunity under Section 5 of the State Immunity Act to halt a civil claim over its alleged deployment of FinSpy spyware against two Bahraini dissidents living in the United Kingdom. The claimants allege that the hacking and surveillance caused psychological harm.
The court found that remotely infecting and monitoring devices located in the UK can constitute causative acts occurring in the UK, even where the foreign state's operators acted abroad. The ruling allows the case to proceed before the High Court of Justice and gives UK-based exiles a clearer route to seek redress for foreign-state spyware operations, although the claimants must still prove Bahrain's attribution, causation, and qualifying injury or property damage.
TTPs, infrastructure, and targeting history in one profile.
8 events from the most recent confirmed update back to the earliest known activity.
The High Court granted summary judgment to Saudi dissident Ghanem Al-Masarir after Saudi Arabia stopped defending the case, awarding approximately £100,000 in general damages and more than £2.5 million in consequential lost earnings. Al-Masarir had presented expert evidence that his iPhones were hacked with Pegasus under conduct directed or authorized by Saudi Arabia or its agents.
Yahya Assiri filed a claim alleging that Saudi Arabia targeted him with spyware between 2018 and 2020.
Yusuf Al-Jamri filed a claim alleging that Bahrain targeted his iPhone with Pegasus spyware in 2019. The High Court stayed the case pending the Shehabi judgment.
Rania Dridi filed a claim alleging that the United Arab Emirates targeted her with Pegasus spyware during broader surveillance of Al Jazeera journalists.
The High Court held that Bahrain was not immune under the State Immunity Act, finding that remotely infecting a computer located in the United Kingdom with spyware was a tortious act in the UK.
The two Bahraini dissidents filed a complaint alleging that Bahrain used FinSpy against their UK-based devices, causing harassment and diagnosed psychiatric injuries.
Saeed Shehabi and Moosa Mohammad alleged that their devices were targeted with FinSpy spyware beginning in 2011.
In Kingdom of Bahrain v. Shehabi and another, the UK Supreme Court held that Bahrain could not invoke state immunity at the jurisdictional stage over alleged FinSpy surveillance of UK-based Bahraini dissidents. The Court held that causative acts against devices in the UK can satisfy the State Immunity Act exception even when foreign-state operators act from abroad, returning the case to the High Court for consideration on its merits.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A UK court ordered Saudi Arabia to pay about **£3 million** (reported by Reuters as **$4.1 million**) to London-based Saudi dissident and satirist **Ghanem Almasarir** after finding he was targeted with **Pegasus** spyware and assaulted in London. The ruling follows a years-long legal battle in which Almasarir alleged that Saudi Arabia orchestrated both the hacking of his iPhone and a physical attack against him, and it marks a rare case in which a foreign state was held financially liable in the UK for alleged cross-border digital surveillance tied to commercial spyware. The case builds on earlier findings from researchers at **Citizen Lab** and **Amnesty International**, who linked suspicious phishing messages sent to Almasarir and other Saudi dissidents abroad to Pegasus, the spyware developed by Israel's **NSO Group**. Reporting in 2018 said the targeting formed part of a broader surveillance campaign against critics of the Saudi government, including activists with links to murdered journalist **Jamal Khashoggi**. In 2022, a British judge allowed Almasarir's lawsuit to proceed, rejecting Saudi Arabia's sovereign immunity defense and finding sufficient evidence for the claim to be heard under the UK's personal injury exception.
Jun 29, 2026
A London High Court judge awarded Saudi satirist and activist **Ghanem Al-Masarir** more than **£3 million (~$4.1M)** in damages after finding a “compelling basis” that his iPhones were hacked using **NSO Group’s Pegasus** spyware, resulting in **data exfiltration**. The court concluded the intrusion was “directed or authorised” by the **Kingdom of Saudi Arabia (KSA)** or agents acting on its behalf, rejecting Saudi Arabia’s attempt to avoid the case via **state immunity** arguments and proceeding after the kingdom stopped participating in the litigation. The ruling cited digital forensic evidence, including analysis by **Citizen Lab** researcher **Bill Marczak**, who identified **malicious text messages** consistent with Pegasus delivery and attributed the infections to the KSA. Al-Masarir alleged the spyware enabled extensive surveillance capabilities—location tracking, access to stored data, and activation of microphones/cameras—and said the targeting coincided with a 2018 physical assault in London that caused injuries and contributed to severe personal and professional harm, including ending his YouTube activity criticizing the Saudi government.
Jun 29, 2026
A UK court ordered the Kingdom of **Saudi Arabia** to pay **£3 million** in damages to London-based Saudi dissident **Ghanem Al-Masarir** after finding his iPhones were infected with **NSO Group’s Pegasus** spyware as part of a 2018 targeting campaign attributed to a Saudi operator dubbed **KINGDOM**. The ruling credited expert evidence from **Citizen Lab** researcher **Bill Marczak**, and the damages award covered injury, costs, and lost earnings tied to the spyware targeting and related harms; the decision was framed by advocates as a rare avenue for accountability for victims of mercenary spyware and transnational repression. Separately, civil society groups warned that spyware vendors linked to human rights abuses are attempting to launder their reputations by engaging with diplomatic initiatives intended to curb misuse of commercial hacking tools. The criticism followed an **NSO Group** “transparency report” highlighting its claimed participation in the **Pall Mall Process**—a French- and UK-led effort to develop governance for *Commercial Cyber Intrusion Capabilities (CCICs)*—even as officials said NSO was not invited and participation does not equate to human-rights compliance; critics pointed to continued allegations of Pegasus abuse, including reported targeting of journalists and civil society in countries such as **Serbia**.
Jun 29, 2026