Loading story…
New reporting and technical analysis have added to scrutiny of NSO Group’s Pegasus spyware, linking the platform to alleged state surveillance abuses and exposing more of the company’s operational model. OCCRP reported that a former Moroccan intelligence officer said Morocco’s domestic intelligence service, the DGST, used intermediary firm FSSYS Maroc to help procure and manage Pegasus while preserving plausible deniability, with a second former intelligence source corroborating the arrangement and researchers pointing to close UAE-Morocco security ties. Separate reporting also said NSO co-founder Shalev Hulio traveled to Panama in 2013 using an Israeli diplomatic passport, a detail cited in records connected to a Panamanian illegal wiretapping investigation involving the interception of communications from politicians, journalists, judges, diplomats, and business figures.
At the same time, Amnesty International’s Security Lab published a detailed technical study based on internal NSO documents disclosed in U.S. litigation, describing Pegasus as a government-sold surveillance platform with per-customer infrastructure, a dedicated White Services support unit, and a Pegasus Anonymizing Transmission Network (PATN). The analysis outlined infection paths across Android and iOS including WhatsApp, iMessage, Voice-over-WiFi, Apple Photos, network injection, physical access, and short-range radio methods, and said NSO’s client-specific infrastructure can enable forensic attribution when the same attacker account appears across victims. Citizen Lab separately highlighted that Pegasus was also used against former MEP Stelios Kouloglou while he served on the European Parliament’s PEGA committee, raising concerns that confidential committee material may have been exposed.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
On July 16, 2026, Amnesty International’s Security Lab published a technical analysis of Pegasus describing NSO Group’s internal architecture, infrastructure, infection workflows, and attribution-relevant infrastructure patterns based on internal documents and prior forensic work.
Former Panamanian president Ricardo Martinelli was acquitted in 2021 after an appeal court found no evidence that he had ordered the interceptions examined in the wiretapping cases.
Documents tied to a 2014 Panamanian investigation referenced Hulio’s diplomatic status while authorities examined alleged interception of communications of more than 150 people, including political rivals, journalists, judges, and diplomats.
An OCCRP investigation reported that NSO Group co-founder Shalev Hulio traveled to Panama in 2013 using an Israeli diplomatic passport, raising questions about NSO Group’s relationship with the Israeli state.
A Citizen Lab page noted a recent finding that former Member of the European Parliament Stelios Kouloglou was hacked with Pegasus while serving on the PEGA committee, potentially exposing confidential documents and deliberations.
An OCCRP report published allegations from former intelligence officer Safir that Morocco’s DGST used FSSYS Maroc as an intermediary to procure and manage NSO Group’s Pegasus spyware, with a second former intelligence source corroborating the arrangement.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
citizenlab.ca
Open sourcecyberveille.ch
Open sourceoccrp.org
Open sourceoccrp.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A leaked dataset reviewed by the Pegasus Project linked NSO Group’s **Pegasus** spyware to the selection of more than **50,000 phone numbers** by government clients, including journalists, lawyers, activists, and political figures across multiple countries. Amnesty International’s Security Lab examined dozens of devices and found **23 confirmed infections** and **14 attempted compromises**, while Citizen Lab validated parts of the forensic work. Reporting tied suspected targeting to at least 10 governments, with prominent cases involving more than 40 Indian journalists, Moroccan and French reporters including **Edwy Plenel**, and Mexican journalist **Cecilio Pineda Birto**, whose number was reportedly selected shortly before his murder. Further forensic investigations expanded the pattern beyond journalists to civil society groups, including six Palestinian human rights defenders whose iPhones were confirmed hacked in 2020 and 2021. Amnesty also published indicators of compromise and a technical methodology through its GitHub repository and **Mobile Verification Toolkit**, documenting Pegasus infrastructure, suspicious processes, and artifacts associated with zero-click exploitation of Apple services such as **iMessage**. NSO Group denied that the leaked list was a roster of Pegasus targets and disputed the scale of abuse, but the combined reporting and device analysis showed repeated use of the spyware against people outside legitimate criminal or terrorism investigations.
Aug 15, 2026
Investigations into **NSO Group’s Pegasus spyware** showed the platform was used by government customers to target journalists, human rights defenders, political opponents, lawyers, diplomats, and other civil society figures. The Pegasus Project reported a leaked list of more than 50,000 phone numbers allegedly selected by NSO clients, including nearly 200 journalists across multiple countries, while reporting in India said current and former military and security officials also appeared in the data as potential surveillance targets, indicating the spyware’s reach extended into sensitive national security circles. In response to malicious cyber activity tied to such tools, the U.S. Department of Commerce added NSO Group and other foreign firms to the **Entity List**. Subsequent technical research from **Citizen Lab** found that NSO customers continued deploying Pegasus in 2022 through three iPhone zero-click exploit chains—`LATENTIMAGE`, `FINDMYPWN`, and `PWNYOURHOME`—against targets including Mexican human rights defenders working on cases involving the military and the Ayotzinapa investigation. The broader spyware market also drew attention to other vendors, including Italy’s **Cy4Gate**, which was reported to market interception, intelligence analysis, and smartphone spyware products such as `Epeius` to government customers in Italy and abroad, underscoring continuing concerns that commercial surveillance capabilities remain available despite repeated abuse scandals and export-control pressure.
Aug 15, 2026
Citizen Lab documented multiple Pegasus infections against civil society targets, including New York Times journalist Ben Hubbard and four Jordanian human rights defenders, lawyers, and journalists. Hubbard’s iPhone was reportedly infected twice through zero-click iMessage exploit chains tied to `KISMET` and `FORCEDENTRY`, after earlier SMS and WhatsApp lure attempts linked to a Saudi-associated operator. In Jordan, researchers found repeated Pegasus targeting between 2019 and 2021 and assessed that two operators, `MANSAF` and `BLACKIRIS`, were likely connected to Jordanian government agencies; one successful iPhone compromise occurred even after Apple sued NSO Group and began notifying victims. Technical reporting and forensic guidance showed Pegasus was built for covert, persistent surveillance across mobile platforms. Google previously identified the Android variant `Chrysaor` on a small number of devices, describing capabilities including privilege escalation, persistence, keylogging, screenshot capture, data theft, and covert microphone use. Reverse-engineering of Pegasus for Android detailed command-and-control over HTTP with encrypted values, SMS-based command execution disguised as verification texts, exfiltration of messages, contacts, call logs, emails, and app data, plus live audio recording, screenshot capture, camera access, and self-deletion features; Amnesty International separately published forensic methodology to help investigators detect Pegasus infections.
Aug 15, 2026