Loading story…
Dozens of countries and technology companies signed the Pall Mall Process declaration in February 2024 to curb the proliferation and irresponsible use of commercial spyware, citing risks to human rights, national security, and cyber stability. The initiative coincided with a U.S. policy to deny visas to people involved in spyware misuse. Google’s Threat Analysis Group reported tracking approximately 40 commercial surveillance vendors and linked 11 of them to exploitation of 74 zero-day vulnerabilities over the preceding decade. These businesses supply governments with turnkey spyware, exploit chains, and infrastructure capable of compromising consumer devices and collecting sensitive information.
Google’s Buying Spying report attributed 35 of 72 known zero-day exploits used in the wild against Google products and the Android ecosystem from mid-2014 through 2023 to commercial surveillance vendors. Documented Pegasus and Predator operations targeted journalists, human rights defenders, and opposition politicians, threatening source confidentiality, civil liberties, and elections. Investigations ranged from Google’s earlier examination of Chrysaor malware on Android to NSO Group’s FORCEDENTRY exploit, Variston’s Heliconia framework, and a 2023 campaign targeting iPhones in Indonesia with Variston’s BridgeHead implant. Google found that rapid patching can disrupt surveillance operations, but public exposure and legal action have not consistently stopped vendors, prompting calls for coordinated international restrictions.
See which actors are running it and whether you're in range.
28 events from the most recent confirmed update back to the earliest known activity.
TAG discovered an NSO Group customer exploiting Chrome zero-day CVE-2023-7024.
CVE-2023-33063, a high-severity vulnerability in Qualcomm Adreno GPUs, first became public in October 2023. Google associated the vulnerability's weaponization with Variston.
Citizen Lab discovered NSO Group's BLASTPASS iOS exploit chain delivering Pegasus to a civil society worker.
TAG and Citizen Lab discovered Predator spyware targeting an Egyptian opposition presidential hopeful.
Chrome patched CVE-2023-3079 within four days of TAG's discovery. Intellexa had deployed the replacement exploit roughly 45 days after patches to its earlier Chrome chain disrupted customer activity for more than 40 days.
TAG observed Intellexa customers using election-related lures to target users in Indonesia and Madagascar.
Thirty-five states endorsed principles concerning government use of surveillance technology at the Summit for Democracy.
A campaign discovered in March 2023 sent SMS links to iPhones running iOS 16.3.0 and 16.3.1 in Indonesia, chaining CVE-2023-28205, CVE-2023-32409, and CVE-2023-28206. TAG did not recover the final implant but assessed that it likely had capabilities similar to BridgeHead.
Galina Timchenko was compromised with Pegasus between February 6 and 26, 2023, around a meeting of exiled media organizations in Berlin. The responsible country remained unidentified.
Apple patched CVE-2023-28205, CVE-2023-28206, and CVE-2023-32409 in April and May 2023. Unknown state-sponsored actors had exploited the vulnerabilities to infect victims with Variston-developed spyware.
María Luisa Aguilar Rodríguez and Santiago Aguirre received Apple threat notifications. Citizen Lab subsequently confirmed that both had been targeted with Pegasus.
A Heliconia campaign used one-time links and a six-vulnerability exploit chain to install BridgeHead spyware on Samsung devices in the United Arab Emirates. The chain combined zero-days with vulnerabilities left exploitable by patch delays.
Cy4Gate acquired RCS Lab, although the companies continued operating separately and maintained their distinct Epeius and Hermit spyware products.
The company behind FinFisher declared insolvency amid an investigation.
Citizen Lab confirmed Pegasus compromises of Centro PRODH's María Luisa Aguilar Rodríguez and Santiago Aguirre during 2022. The compromises required no user interaction.
TAG discovered an RCS Lab campaign using fake iOS and Android applications against users in Italy and Kazakhstan. Its iOS application included known privilege-escalation exploits and zero-days CVE-2021-30883 and CVE-2021-30983.
Four Nexa Technologies executives were indicted in France for alleged complicity in torture through surveillance technology sales.
Five Chrome and Android zero-days were reported in 2021 that TAG later assessed with high confidence had been packaged by Intellexa. TAG assessed that the resulting hacking software was sold to at least eight governments.
NSO Group's FORCEDENTRY zero-click chain compromised a Saudi Arabian human rights defender using a PDF disguised as a GIF. The chain bypassed BlastDoor and exploited CVE-2021-30860 and CVE-2021-31010.
Citizen Lab identified repeated Pegasus infections affecting Carlos Dada and 21 El Faro colleagues between June 2020 and November 2021. Reporter Carlos Martínez's device experienced an infection lasting 269 days.
Tal Dilian founded the Intellexa Alliance, bringing together companies including Cytrox, Nexa Technologies, WiSpear, and Senpai to supply surveillance capabilities.
Spain-based Variston acquired Truel IT, a company associated with the development of commercial surveillance technology.
The U.S. Department of State announced a policy to deny visas to individuals it deems involved in the misuse of dangerous spyware technology.
Dozens of countries, including France, the United Kingdom, and the United States, joined Google, MDSec, Meta, and Microsoft in signing a declaration to curb commercial spyware abuse. The initiative seeks guiding principles and policy options governing commercial cyber intrusion tools.
Google's research described approximately 40 commercial surveillance vendors and attributed 35 of 72 known in-the-wild zero-day exploits affecting Google products and the Android ecosystem from mid-2014 through 2023 to those vendors. It also disclosed technical findings on Epeius, Heliconia, and other spyware, linking vendors including NSO Group, Intellexa/Cytrox, Candiru, Cy4Gate, Variston, and PARS Defense to exploited vulnerabilities.
TAG observed infection links associated with Negg Group's VBiss spyware targeting users in Italy, Malaysia, and Kazakhstan.
Apple disrupted FORCEDENTRY by restricting IMTranscoderAgent file formats in iOS 14.8.1, moving GIF processing into BlastDoor in iOS 15, and reducing abused NSExpression capabilities in iOS 15.1.
Carlos Dada and 14 El Faro colleagues sued NSO Group in California with the Knight First Amendment Institute after Pegasus infections affected the newsroom.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
3 references tracked. Mallory keeps watching after this page renders.
thehackernews.com
Open sourceandroid-developers.googleblog.com
Open sourcestorage.googleapis.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Google Threat Intelligence Group (GTIG) reported tracking **90 zero-day vulnerabilities exploited in the wild during 2025**, up from 78 in 2024 (and below the 2023 peak of 100). GTIG said it could directly attribute exploitation for 42 of the 90, including **18** assessed as definitively or likely used by **commercial surveillance vendors (CSVs)**, while **state-sponsored espionage groups** (including PRC-, Russia-, and UAE-linked activity) continued to exploit zero-days—often prioritizing **edge devices and security appliances** (e.g., routers, firewalls, VPN and other perimeter technologies) to gain organizational access. The report also highlighted vendor and platform targeting patterns, with **Microsoft** products most frequently affected, followed by **Google** and **Apple**, and noted shifts in target categories such as fluctuating mobile-device zero-days and a decline in browser zero-days. Google’s accompanying analysis emphasized that, for the first time in its tracking, **attributed CSV exploitation exceeded traditional state-sponsored cyber-espionage attribution**, reflecting a broader trend of commercial exploit capabilities being productized and used by a wider set of customers. Separate commentary on exploitation timelines argued that the window between disclosure and exploitation has rapidly compressed—citing a “Zero Day Clock” dataset built from thousands of CVE-to-exploit observations and additional findings (e.g., a material share of known-exploited vulnerabilities being weaponized on or before CVE publication)—reinforcing that defenders should assume faster weaponization and reduced patching lead time for high-value targets, especially perimeter and mobile/browser attack surfaces.
Jul 20, 2026
U.S. Immigration and Customs Enforcement confirmed to lawmakers that it bought and used Paragon Solutions spyware, including **Graphite**, in investigations tied to drug trafficking, fentanyl networks, and other organizations using encrypted communications. Acting ICE Director Todd Lyons said the deployment complied with constitutional requirements and the 2023 executive order restricting government use of commercial spyware, but House Democrats including **Rep. Summer Lee** said ICE had not provided enough documentation, safeguards, or oversight to justify such invasive surveillance. The disclosure followed the reactivation of ICE’s Paragon contract after an earlier suspension for review, and came amid wider controversy over reports linking Paragon spyware to targeting of journalists and activists. The admission intensified concerns that U.S. policy may be softening toward the commercial spyware industry even as evidence mounts that these vendors are driving serious cyber abuse. Reporting and research cited growing alarm over the lifting of sanctions on Intellexa executives, new U.S.-linked ownership of **NSO Group** and Paragon, and the expanding role of brokers, resellers, and other intermediaries that help spyware vendors evade export controls and obscure supply chains. Analysts also noted that Google attributed more zero-day exploitation to commercial surveillance vendors than to traditional state-backed groups in 2025, while lawmakers pressed for briefings on federal spyware use and U.S. investment in firms long associated with abuses involving **Pegasus**, **Predator**, and related surveillance tools.
Jun 29, 2026
Investigations and legal filings described a growing **mercenary spyware** market in which private vendors developed and sold intrusion capabilities to government customers, with **NSO Group** emerging as the best-known example but not the only one. Reporting tied NSO’s **Pegasus** spyware to attacks on activists, journalists, and government personnel, including the targeting of UAE activist Ahmed Mansoor and more than **1,400 devices** via a WhatsApp exploit that reportedly required no answer from the victim. Microsoft, Google, Cisco, GitHub, LinkedIn, VMware, and others backed WhatsApp’s lawsuit against NSO, arguing the company should not receive sovereign immunity for operating as a private offensive cyber actor, while broader reporting said Facebook had identified **seven** spyware firms targeting roughly **50,000** people across its platforms. Separate investigations showed the industry stretching beyond NSO into Europe and Asia. Lighthouse Reports linked Italy’s **RCS Lab** and its Tykelab unit to covert mobile-phone tracking through telecom signaling weaknesses and to **Hermit** spyware infrastructure, while Citizen Lab and Motherboard connected a fake WhatsApp phishing campaign to Italian vendor **Cy4Gate** and its **Epeius** lawful-intercept product. Earlier reporting on **Hacking Team** and allegations about **APT17** selling stolen data underscored how surveillance and intrusion capabilities have been commercialized, repackaged, and marketed across borders, despite repeated scandals, lawsuits, and sanctions aimed at curbing abuse.
Aug 15, 2026