Loading malware…
Pegasus is a commercial mercenary spyware platform developed by NSO Group and used by government customers for highly targeted surveillance operations. It is designed to compromise mobile devices, particularly iPhones and Android phones, and provide operators with deep access to device contents and sensors. Reported capabilities include collection of messages, emails, photos, contacts, call records, and other stored data, as well as covert activation of the microphone and camera, call recording, location tracking, screenshot capture, and broader monitoring of device activity. Technical analyses of the Android implant have also documented collection from numerous applications and local data stores, upgrade functionality, and multiple self-removal mechanisms intended to reduce forensic exposure.
Pegasus has been associated with sophisticated exploit chains, including zero-click attacks delivered through messaging services such as iMessage and earlier abuse of WhatsApp calling functionality. Public reporting has linked Pegasus to exploit chains such as FORCEDENTRY and BLASTPASS against Apple devices, demonstrating use of advanced initial access methods that can require little or no user interaction. Vendors have repeatedly patched vulnerabilities exploited by Pegasus, and Apple has cited Pegasus as a representative example of mercenary spyware in its threat-notification program.
The spyware has been repeatedly tied to surveillance of journalists, activists, lawyers, politicians, diplomats, dissidents, and other high-risk individuals across multiple countries. Investigations by organizations including Citizen Lab and Amnesty International have documented Pegasus infections or attempted compromise in cases involving civil society, media, and political targets, and broader collaborative reporting has alleged misuse by government clients beyond legitimate criminal or counterterrorism purposes. NSO Group has consistently stated that Pegasus is sold only to vetted government customers for use against terrorists and criminals, while denying responsibility for unlawful targeting.
Pegasus is notable both for its technical sophistication and for its role in the global mercenary spyware ecosystem. It exemplifies the commercialization of advanced offensive cyber capabilities, combining exploit development, covert device compromise, extensive surveillance functionality, and operational stealth in a platform that has had significant legal, diplomatic, and human-rights impact worldwide.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
7 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
The latest Pegasus spyware campaign targeted at least nine Bahraini activists, a French lawyer, and an Indian journalist via a new iOS exploit, dubbed FORCEDENTRY. This was a highly sophisticated zero-click, 0day vulnerability in iMessage, meaning it could be triggered without the intended victim either viewing the message sent by the threat actors or clicking the link contained in the message. | The latest Pegasus spyware campaign targeted at least nine Bahraini activists, a French lawyer, and an Indian journalist via a new iOS exploit, dubbed FORCEDENTRY.
CVE-2019-3568: heap overflow в VOIP-стеке. Buffer overflow в VoIP-стеке WhatsApp - одна из первых публично задокументированных zero-click цепочек NSO Group... По данным WhatsApp/Meta... уязвимость использовалась против примерно 1400 устройств за двухнедельный период. | Устройство было полностью скомпрометировано Pegasus от NSO Group.
CVE-2023-41064 - переполнение буфера (CWE-120, Buffer Copy without Checking Size of Input) в компоненте ImageIO. Обработка специально сформированного изображения приводит к выполнению произвольного кода. | Разбираешь sysdiagnose-дамп через MVT - а оттуда лезут IOC-паттерны Pegasus и Predator... Pegasus spyware от NSO Group - эталон по адаптивности.
BLASTPASS: цепочка CVE-2023-41061 + CVE-2023-41064. CVE-2023-41061 - ошибка валидации (CWE-20, Improper Input Validation) в компоненте Wallet. Специально сформированное вложение PassKit приводит к выполнению произвольного кода. | Разбираешь sysdiagnose-дамп через MVT - а оттуда лезут IOC-паттерны Pegasus и Predator... Pegasus spyware от NSO Group - эталон по адаптивности.
Defendants’ products included “Pegasus,” a type of spyware known as a remote access trojan. According to Defendants, Pegasus and its variants (collectively, “Pegasus”) were designed to be remotely installed and enable the remote access and control of information—including calls, messages, and location—on mobile devices using the Android, iOS, and BlackBerry operating systems. | On information and belief, in order to enable Pegasus’ remote installation, Defendants exploited vulnerabilities in operating systems and applications (e.g., CVE-2016-4657) and used other malware delivery methods, like spearphishing messages containing links to malicious code.
Apple patched two zero-days tagged by Citizen Lab as being exploited in attacks as part of an exploit chain known as BLASTPASS to infect fully-patched iPhones with NSO Group's Pegasus mercenary spyware.
"This level of sophistication resembles other exploits developed by the commercial surveillance industry. These are private companies that also developed prominent spyware tools like Pegasus and Predator."
8 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Une entreprise en particulier a souvent été accusée d’être à l’origine de ces attaques : NSO Group. Le fabricant du tristement célèbre logiciel espion Pegasus nie toute responsabilité... les éditeurs de logiciels ont été contraints de corriger les failles logicielles exploitées par Pegasus.
The latest Pegasus spyware campaign targeted at least nine Bahraini activists, a French lawyer, and an Indian journalist via a new iOS exploit, dubbed FORCEDENTRY.
New York Times journalist Ben Hubbard was repeatedly targeted with NSO Group’s Pegasus spyware over a three-year period from June 2018 to June 2021.
Phones belonging to four Jordanian human rights defenders, lawyers, and journalists were hacked with NSO Group’s Pegasus spyware between August 2019 and December 2021.
Phones belonging to four Jordanian human rights defenders, lawyers, and journalists were hacked with NSO Group’s Pegasus spyware between August 2019 and December 2021.
Amnesty International has uncovered targeted digital attacks against two prominent Moroccan Human Rights Defenders (HRDs) using NSO Group’s Pegasus spyware.
23 distinct techniques documented for this family, organized by ATT&CK tactic.
The NSO Group sold governments a program called Pegasus, which could be installed on a device simply by calling the device via WhatsApp; the device’s owner did not even have to answer.
In 2023, Citizen Lab documented BLASTPASS, an NSO Group Pegasus exploit chain that targeted iPhones through maliciously crafted iMessage content and was capable of compromising devices without victim interaction.
These tools allow the user to track someone’s whereabouts, listen in on their conversations, read their texts and emails, look at their photographs, steal their contacts list, download their data, review their internet search history and more.
The agent loads uglmt.dat as a dex file using DexClassLoader and then calls the “com.media.provapp.DrivenObjClass.perfU” method
At the centre of this investigation is NSO Group’s Pegasus spyware which, when surreptitiously installed on victims’ phones, allows an attacker complete access to the device’s messages, emails, media, microphone, camera, calls and contacts.
The agent constructs the following URL that contains the C2 server, which can be extracted from the initial configuration or a command sent via SMS... The malware adds “SessionId1” and “SessionId2” to the HTTP headers... The HTTP response should be an XML file containing at least the following fields: “response”, “code”, and “message”. | 1. HTTP Communication... The agent constructs the following URL that contains the C2 server... The malware creates an XmlSerializer object that will be encrypted using the AES algorithm and then sent to a C2 server via HTTP.
313 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
200 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Mercenary spyware used in targeted attacks against high-value individuals such as journalists, activists, politicians, and diplomats. If it infects a device, it can bypass built-in encryption, access private files, spy on conversations, record audio and video, track location, and take control of the device.
Mobile spyware mentioned only in passing via a linked article title about detecting and defending against spy apps.
Well-documented commercial spyware from NSO Group used for highly targeted surveillance of iPhones, including zero-click compromise via exploit chains delivered through iMessage.
A mercenary spyware platform referenced as an example of highly sophisticated targeted spyware operations.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.