Pegasus: The Spyware That Can Read Everything
Pegasus, developed by Israeli company NSO Group, is the most sophisticated commercial spyware ever documented. It can compromise any iPhone or Android phone without the target clicking anything. Once installed, it accesses everything.
What Pegasus can do
Once on a device, Pegasus provides:
- Complete message history (including Signal, WhatsApp, iMessage)
- Real-time location tracking
- Microphone and camera activation
- Stored photos and videos
- Call recordings
- Email and browser history
- Contacts and calendar
- Passwords and credentials stored on the device
- Encrypted app data (reads data before it’s encrypted)
Zero-click exploits
Pegasus doesn’t require the target to click a link or open a file. NSO Group develops zero-click exploits that compromise devices through:
- iMessage processing vulnerabilities
- WhatsApp call handling bugs
- Zero-day vulnerabilities in OS components
The target receives no notification. There is no visible indication of compromise. The phone functions normally while Pegasus exfiltrates everything.
Documented victims
Citizen Lab at the University of Toronto has documented Pegasus targeting:
- Journalists at Al Jazeera, Reuters, and Le Monde
- Human rights activists in Mexico, Morocco, and Bahrain
- Political opposition leaders in multiple countries
- The fiancee of Jamal Khashoggi (murdered Saudi journalist)
- EU officials and diplomats
- Catalan independence movement leaders
Government clients
NSO Group sells exclusively to governments. Documented clients include: Mexico, Saudi Arabia, UAE, Morocco, Rwanda, India, Hungary, Spain, and others. At least 45 countries have been identified as Pegasus operators.
Why this matters
Pegasus represents the ceiling of surveillance capability. Every privacy tool we discuss (encryption, VPNs, private browsers) is bypassed by Pegasus because it operates at the device level, below all application security.
Physical counter-surveillance (knowing where cameras are, detecting trackers) remains relevant even against Pegasus, because physical surveillance infrastructure is separate from device compromise. But understanding that tools like Pegasus exist is essential context for any privacy discussion.
Pegasus is the extreme case. Most people aren’t targeted by nation-state spyware. But the technology trickles down: lesser spyware tools (Predator, Candiru, Cytrox) offer similar capabilities at lower prices to more customers.