Skip to content

Pegasus

Pegasus is spyware developed by Israeli firm NSO Group that covertly infects phones to extract data and surveil journalists, activists, and officials.

Known aliases

  • NSO Pegasus
  • Pegasus spyware

Current stories

securityOne report1 publisher

NSO held sole control of the Pegasus infection module in Poland, prosecutors say

Poland's National Prosecutor's Office says the Central Anti-Corruption Bureau, which ran Pegasus, lacked full control of a system NSO Group operated. Investigators say NSO had technical access to harvested data but cannot say whether it obtained specific material.

Publishers:therecord.media

Reality

Evidence55
Adoption
Not scored
Hype gap+30
Incentives60
Confidence55
securityOne report1 publisher

California judge again dismisses El Faro journalists' Pegasus suit against NSO Group

El Faro journalists have lost their Pegasus lawsuit against NSO Group for a second time after a California federal judge found no jurisdiction in the state. Pointing to compromised infrastructure in California did not tie a Salvadoran newsroom's case to the state's courts.

Publishers:therecord.media

Reality

Evidence55
Adoption
Not scored
Hype gap+5
Incentives
Not scored
Confidence62
productOne report1 publisher

Paragon relies on outsiders to catch misuse of its Graphite spyware

Paragon CEO Andrew Boyd says the spyware maker cannot see whom its customers target, and that halting updates leaves their systems ineffective in about 12 hours. Its promise to drop abusive customers therefore waits on outsiders finding the abuse first.

Publishers:wired.com

Reality

Evidence62
Adoption
Not scored
Hype gap+45
Incentives70
Confidence60
productOne report1 publisher

Paragon CEO Andrew Boyd says withholding updates is how the spyware maker cuts off abusers

Paragon CEO Andrew Boyd says the spyware maker can't see who customers target, and withheld updates leave a customer's system ineffective in about 12 hours. Its zero-tolerance misuse policy depends on outside researchers to find abuse before that slow cutoff comes into play.

Publishers:wired.com

Reality

Evidence55
Adoption
Not scored
Hype gap+45
Incentives65
Confidence55
securityConfirmed4 publishers

Apple's spyware alerts reached 110 countries, and they land on people, not fleets

Apple's latest mercenary spyware notifications went to users in 110 countries. The response checklist is per-person, and a standard MDM baseline covers almost none of it.

Perspective Coverage

4 publishers
Builder
Builder 16%
Operator
Operator 79%
Investor
Investor 5%

Reality

Evidence60
Adoption
Not scored
Hype gap+10
Incentives40
Confidence65
productConfirmed3 publishers

Apple's spyware notices reach 110 countries, and Lockdown Mode becomes a baseline control

Apple told TechCrunch it warned selected users across 110 countries on Thursday. For any org with journalists, diplomats or executives on iOS, the hardened profile is no longer an edge case.

Perspective Coverage

3 publishers
Builder
Builder 12%
Operator
Operator 75%
Investor
Investor 13%

Reality

Evidence58
Adoption
Not scored
Hype gap+10
Incentives50
Confidence68
securityConfirmed7 publishers

Apple threat notifications led one of twelve Serbians to a forensics lab that confirmed Pegasus infection

SHARE Foundation, Citizen Lab and Amnesty confirmed three infections among at least 14 Serbian targets around the March local elections, and the Android half of the wave was installed by hand during police custody.

Perspective Coverage

7 publishers
Builder
Builder 20%
Operator
Operator 66%
Investor
Investor 14%

Reality

Evidence72
Adoption30
Hype gap+15
Incentives45
Confidence70
securityOne report1 publisher

Mercenary spyware targeting reached three Turkish ministers on hardened, encrypted phones

At least three Turkish cabinet ministers turned up in Apple's latest mercenary spyware notification batch. Ankara's remediation ran ahead of any identification of the tool, and it may have to stay that way.

Publishers:turkiyetoday.com

Reality

Evidence35
Adoption38
Hype gap+14
Incentives62
Confidence42
securityOne report1 publisher

Twenty-nine MEPs ask the Commission to slow Serbia's accession over Pegasus and NoviSpy findings

A letter signed Friday turns device forensics on Serbian student activists into an enlargement demand, though the signatory who spoke to CyberScoop says spyware will not be the deciding factor if Brussels moves.

Publishers:cyberscoop.com

Reality

Evidence58
Adoption22
Hype gap+32
Incentives68
Confidence55
securityOne report1 publisher

The EncroChat "national security secret" was exploit code sitting on GitHub

Computer Weekly says a Czech firm rehacked France's EncroChat implant and found GitHub exploit code for Bad Binder, an Android bug unpatched in 2.5 billion phones. Lawyers expect a stalled UK case to restart.

Publishers:computerweekly.com

Reality

Evidence52
Adoption68
Hype gap+14
Incentives58
Confidence50
investOne report1 publisher

Apple moved its spyware warnings to the Lock Screen. Your incident alerts are still in email.

Thursday's round of Apple threat notifications reached targets in 110 countries, and the delivery change is the lesson: an alert sent to an inbox is one you have to hope someone opens.

Reality

Evidence33
Adoption44
Hype gap+18
Incentives62
Confidence40
buildOne report1 publisher

The Crypto Wars Ended, And The Prize Went To Whoever Owns Your Endpoint

Matthew Green's argument is that backdoors lost and lawful access still won, by moving to device exploitation. That relocates the defender's problem from protocol design to fleet integrity.

Publishers:dev.to

Reality

Evidence26
Adoption
Not scored
Hype gap+38
Incentives44
Confidence33