Loading story…
Citizen Lab documented multiple Pegasus infections against civil society targets, including New York Times journalist Ben Hubbard and four Jordanian human rights defenders, lawyers, and journalists. Hubbard’s iPhone was reportedly infected twice through zero-click iMessage exploit chains tied to KISMET and FORCEDENTRY, after earlier SMS and WhatsApp lure attempts linked to a Saudi-associated operator. In Jordan, researchers found repeated Pegasus targeting between 2019 and 2021 and assessed that two operators, MANSAF and BLACKIRIS, were likely connected to Jordanian government agencies; one successful iPhone compromise occurred even after Apple sued NSO Group and began notifying victims.
Technical reporting and forensic guidance showed Pegasus was built for covert, persistent surveillance across mobile platforms. Google previously identified the Android variant Chrysaor on a small number of devices, describing capabilities including privilege escalation, persistence, keylogging, screenshot capture, data theft, and covert microphone use. Reverse-engineering of Pegasus for Android detailed command-and-control over HTTP with encrypted values, SMS-based command execution disguised as verification texts, exfiltration of messages, contacts, call logs, emails, and app data, plus live audio recording, screenshot capture, camera access, and self-deletion features; Amnesty International separately published forensic methodology to help investigators detect Pegasus infections.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
17 events from the most recent confirmed update back to the earliest known activity.
Cyber Geeks published the second part of its Pegasus for Android analysis, describing command-and-control communications, SMS command handling, live audio surveillance, outbound SMS telemetry, and keylogging. The article further documented how the Android implant authenticated SMS commands and exfiltrated data.
Cyber Geeks published the first part of its reverse-engineering analysis of Pegasus for Android, detailing initialization, configuration retrieval, targeted data sources, core C2 commands, and self-removal mechanisms. The analysis covered the Android sample with SHA-256 ade8bef0ac29fa363fc9afd958af0074478aef650adeb0318517b48bd996d5d5.
Suhair Jaradat's iPhone was successfully hacked on December 5, 2021. Citizen Lab highlighted this as evidence that Pegasus activity on Apple devices continued after Apple sued NSO Group and notified victims in November 2021.
The same anonymous Jordanian woman human rights defender and journalist was hacked again on or around October 5, 2021. The repeated compromises were part of Pegasus targeting of Jordanian civil society.
An anonymous Jordanian woman human rights defender and journalist had her phone hacked on or around October 3, 2021. The report says her device was compromised at least twice in October 2021.
Amnesty International published its forensic methodology report on how to detect NSO Group's Pegasus spyware. The report became a cited reference point for Pegasus forensic investigations.
Citizen Lab concluded with high confidence that Ben Hubbard's iPhone was infected again on June 13, 2021. The infection was linked to a zero-click iMessage exploit chain associated with FORCEDENTRY.
Ahmed Al-Neimat's phone was hacked on or around January 28, 2021 for approximately two days. Logs indicated a zero-click Pegasus exploit likely involving FORCEDENTRY.
Researchers assessed that the suspected Pegasus operator BLACKIRIS had been active since at least December 2020 and was focused on Jordanian targets. The operator is believed likely to be an agency of the Jordanian government.
Citizen Lab concluded with high confidence that Ben Hubbard's iPhone was infected with Pegasus on July 12, 2020. The infection likely used a zero-click iMessage exploit chain associated with KISMET.
Malik Abu Orabi received another Pegasus-linked SMS message on March 20, 2020. The messages formed part of a campaign in which his phone was hacked repeatedly between 2019 and 2021.
A second Pegasus-linked SMS message was sent to Malik Abu Orabi on September 29, 2019. Researchers later tied lure domains used in such messages to Pegasus infrastructure focused on Jordan.
Malik Abu Orabi's phone contained a Pegasus-linked SMS message sent on September 22, 2019. The message was part of a broader Pegasus targeting campaign against Jordanian civil society figures.
Researchers assessed that the suspected Pegasus operator MANSAF had been active since at least December 2018 and was primarily focused on Jordanian targets. The operator is believed likely to be an agency of the Jordanian government.
Citizen Lab found forensic artifacts linked to NSO Group on Ben Hubbard's iPhone as early as April 2018. The report says it could not confirm whether these artifacts reflected a genuine infection attempt or a feasibility test.
Google disclosed Chrysaor as a newly discovered Android spyware family used in highly targeted attacks and said it was believed to have been created by NSO Group and related to Pegasus. Google found fewer than three dozen infected devices, notified affected users, disabled the apps, and updated Verify Apps protections.
The report states that FinFisher spyware was detected in Jordan, cited as evidence that the Jordanian government appears to have used spyware for years. It also notes that no civil society targets of FinFisher in Jordan had previously been publicly identified.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
6 references tracked. Mallory keeps watching after this page renders.
citizenlab.ca
Open sourcecitizenlab.ca
Open sourcecybergeeks.tech
Open sourcecybergeeks.tech
Open sourceamnesty.org
Open sourcesecurity.googleblog.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A leaked dataset reviewed by the Pegasus Project linked NSO Group’s **Pegasus** spyware to the selection of more than **50,000 phone numbers** by government clients, including journalists, lawyers, activists, and political figures across multiple countries. Amnesty International’s Security Lab examined dozens of devices and found **23 confirmed infections** and **14 attempted compromises**, while Citizen Lab validated parts of the forensic work. Reporting tied suspected targeting to at least 10 governments, with prominent cases involving more than 40 Indian journalists, Moroccan and French reporters including **Edwy Plenel**, and Mexican journalist **Cecilio Pineda Birto**, whose number was reportedly selected shortly before his murder. Further forensic investigations expanded the pattern beyond journalists to civil society groups, including six Palestinian human rights defenders whose iPhones were confirmed hacked in 2020 and 2021. Amnesty also published indicators of compromise and a technical methodology through its GitHub repository and **Mobile Verification Toolkit**, documenting Pegasus infrastructure, suspicious processes, and artifacts associated with zero-click exploitation of Apple services such as **iMessage**. NSO Group denied that the leaked list was a roster of Pegasus targets and disputed the scale of abuse, but the combined reporting and device analysis showed repeated use of the spyware against people outside legitimate criminal or terrorism investigations.
Aug 15, 2026
New reporting and technical analysis have added to scrutiny of **NSO Group’s Pegasus spyware**, linking the platform to alleged state surveillance abuses and exposing more of the company’s operational model. OCCRP reported that a former Moroccan intelligence officer said Morocco’s domestic intelligence service, the **DGST**, used intermediary firm **FSSYS Maroc** to help procure and manage Pegasus while preserving plausible deniability, with a second former intelligence source corroborating the arrangement and researchers pointing to close UAE-Morocco security ties. Separate reporting also said NSO co-founder **Shalev Hulio** traveled to Panama in 2013 using an Israeli diplomatic passport, a detail cited in records connected to a Panamanian illegal wiretapping investigation involving the interception of communications from politicians, journalists, judges, diplomats, and business figures. At the same time, Amnesty International’s Security Lab published a detailed technical study based on internal NSO documents disclosed in U.S. litigation, describing Pegasus as a government-sold surveillance platform with per-customer infrastructure, a dedicated **White Services** support unit, and a **Pegasus Anonymizing Transmission Network (PATN)**. The analysis outlined infection paths across **Android** and **iOS** including **WhatsApp**, **iMessage**, Voice-over-WiFi, Apple Photos, network injection, physical access, and short-range radio methods, and said NSO’s client-specific infrastructure can enable forensic attribution when the same attacker account appears across victims. Citizen Lab separately highlighted that Pegasus was also used against former MEP **Stelios Kouloglou** while he served on the European Parliament’s **PEGA** committee, raising concerns that confidential committee material may have been exposed.
Jul 28, 2026
Investigations into **NSO Group’s Pegasus spyware** showed the platform was used by government customers to target journalists, human rights defenders, political opponents, lawyers, diplomats, and other civil society figures. The Pegasus Project reported a leaked list of more than 50,000 phone numbers allegedly selected by NSO clients, including nearly 200 journalists across multiple countries, while reporting in India said current and former military and security officials also appeared in the data as potential surveillance targets, indicating the spyware’s reach extended into sensitive national security circles. In response to malicious cyber activity tied to such tools, the U.S. Department of Commerce added NSO Group and other foreign firms to the **Entity List**. Subsequent technical research from **Citizen Lab** found that NSO customers continued deploying Pegasus in 2022 through three iPhone zero-click exploit chains—`LATENTIMAGE`, `FINDMYPWN`, and `PWNYOURHOME`—against targets including Mexican human rights defenders working on cases involving the military and the Ayotzinapa investigation. The broader spyware market also drew attention to other vendors, including Italy’s **Cy4Gate**, which was reported to market interception, intelligence analysis, and smartphone spyware products such as `Epeius` to government customers in Italy and abroad, underscoring continuing concerns that commercial surveillance capabilities remain available despite repeated abuse scandals and export-control pressure.
Aug 15, 2026