NSO Group Technologies is an Israeli cybersecurity company founded in 2010. Its flagship product, Pegasus, is a zero-click surveillance implant for iOS and Android that can silently exfiltrate messages, emails, call records, location data, and photos; activate the microphone and camera without the target's knowledge; and intercept end-to-end encrypted communications by reading them before encryption or after decryption. NSO Group licenses Pegasus exclusively to governments and intelligence agencies. The company's stated policy requires customers to use the tool only against criminals and terrorists. The documented evidence shows something different.

Pegasus has been used to surveil journalists, human rights defenders, opposition politicians, heads of state, and the associates of targets including Saudi journalist Jamal Khashoggi, who was murdered inside the Saudi consulate in Istanbul in October 2018. The story of Pegasus is not just the story of a surveillance tool. It is the story of a commercial market for offensive cyber capabilities - state-grade malware available for hire to any government that can pay the licensing fee, with accountability limited only by the willingness of licensing governments to investigate their own use of the tool.

The Technical Architecture

Pegasus is a full-chain mobile exploitation platform. "Full-chain" means it doesn't rely on the target doing anything - there is no phishing link to click, no attachment to open. A zero-click exploit chain uses vulnerabilities in system services that process untrusted input without user interaction: iMessage, FaceTime, the cellular baseband processor, push notification handlers. The target receives a specially crafted payload via one of these channels; the vulnerability executes; and Pegasus installs silently. The target's phone continues to function normally, with no visible indication of compromise.

The 2021 "Forced Entry" exploit (CVE-2021-30860, discovered by Citizen Lab and Project Zero) used a zero-click vulnerability in the JBIG2 image compression format parser in CoreGraphics. JBIG2 does not support scripting, but NSO Group's exploit used the image format's compression primitives to construct a virtual machine within the decompressor - essentially creating a Turing-complete computing environment inside a PDF parser, from which shellcode could be executed. This was described by Google Project Zero researchers as "one of the most technically sophisticated exploits" they had ever seen.

Earlier Pegasus versions used "one-click" exploits delivered via SMS links (the "Trident" chain in 2016 used three iOS zero-days: CVE-2016-4657, CVE-2016-4655, CVE-2016-4656). The transition to zero-click delivery reflected both technical capability advancement and operational need - targets who understand they might be surveilled learn not to click unknown links. Zero-click removes that defense entirely.

[TECHNICAL NOTE]
Pegasus's persistence mechanism and C2 architecture: once installed, Pegasus uses system-level hooks to survive reboots, app updates, and in some cases iOS upgrades. The implant communicates with operator-controlled C2 servers via HTTPS, disguised as legitimate traffic. Citizen Lab analysis identified a distinctive Pegasus network fingerprint - a redirection chain through specific domain patterns and IP ranges. The architecture uses a "Phantom Phone" design: a legitimate-looking infrastructure layer that makes network forensics difficult. The implant can exfiltrate via WiFi or cellular, choosing the least suspicious method. On iOS, Pegasus exploited the TrustCache to install as a "trusted" application exempt from code-signing checks. Forensic detection of Pegasus became possible through the Mobile Verification Toolkit (MVT), developed by Amnesty Tech, which analyzes iOS backups and Android forensic dumps for known indicators: suspicious process names, network logs, kernel panic logs (from failed exploit attempts), and backup anomalies.

Documented Targets and Operations

The scale of Pegasus use became clear in July 2021 when the Pegasus Project - a consortium of 17 media organizations coordinated by Forbidden Stories, with technical analysis by Amnesty International's Security Lab and Citizen Lab - published findings based on a leaked list of 50,000 phone numbers believed to be targets or potential targets of Pegasus customers. Forensic analysis of phones confirmed Pegasus infections on devices belonging to journalists at Le Monde, the Financial Times, the Wall Street Journal, Al Jazeera, and dozens of other publications. Human rights activists in Morocco, Mexico, Rwanda, India, Hungary, Azerbaijan, and Saudi Arabia had their devices compromised.

The number 50,000 is not the confirmed number of infections - it is the number of numbers on a list that includes surveillance targets, potential targets, and other context. Amnesty and Citizen Lab confirmed Pegasus infections on 37 phones in their forensic sample. The scale of the wider surveillance program implied by the list was substantially larger. Mexico alone had approximately 15,000 numbers on the list, including journalists, politicians, and judges.

The most high-profile case was the pre-murder surveillance of Jamal Khashoggi. Citizen Lab found that the phone of Omar Abdulaziz, a close Khashoggi associate in Canada, was infected with Pegasus in 2018 - the months during which Khashoggi and Abdulaziz were communicating about a planned political organization. Abdulaziz later filed a lawsuit in Israel against NSO Group. The Saudi-operated Pegasus was active on Abdulaziz's phone during the period that Khashoggi was communicating plans that Saudi intelligence would have found threatening. Khashoggi was killed in October 2018. The CIA assessed with high confidence that Saudi Crown Prince Mohammed bin Salman approved the operation.

[WARNING]
The Pegasus case illustrates a structural problem in the commercial spyware market: export controls and licensing terms are insufficient to prevent misuse when the customer is a government that controls its own accountability mechanisms. NSO Group's licensing contracts prohibit use against journalists and human rights defenders and claim to require government customers to limit use to lawful surveillance of serious criminals and terrorists. But the company has no operational visibility into how customers deploy the tool after licensing - it doesn't see the C2 traffic, can't audit target lists, and relies entirely on customers self-reporting misuse. When the customer government is the one misusing the tool, there is no enforcement mechanism. The US blacklisting of NSO Group in November 2021 (Entity List, Department of Commerce) blocked US companies from selling technology to NSO Group, significantly impacting its ability to source components for its products. Several US investors divested. But Pegasus continued to be used by existing customers, and competitors (Candiru, Intellexa, Paragon) continued operating.

The Broader Market

NSO Group is not unique. The commercial spyware market includes dozens of vendors offering similar products: Candiru (Israeli, acquired by a different holding company after US blacklisting), Intellexa (Greek-registered, created by former Israeli intelligence officer Tal Dilian), FinFisher/FinSpy (German origin, subsequently acquired), Hacking Team (Italian, breached in 2015 with all source code leaked), Paragon Solutions (Israeli, reportedly acquired by AE Industrial Partners, a US private equity firm, before subsequent complications), and others. The market has expanded because customer demand - from authoritarian governments and democracies alike - significantly outpaces accountability mechanisms.

Citizen Lab has documented Pegasus use in at least 45 countries. Google's Threat Analysis Group tracks what it calls "commercial surveillance vendors" (CSVs) and has identified over 40 companies active in this space. The 2024 US Executive Order on commercial spyware attempted to restrict US government use of these tools and strengthen export controls, but did not address foreign government use or the broader market dynamics.

Apple, Google, and Meta have all filed lawsuits against NSO Group. Apple's November 2021 suit sought to permanently ban NSO Group from using Apple products or services; the case was ongoing as of 2024. Apple began notifying users of state-sponsored spyware attacks in November 2021, alerting targets in 150+ countries when forensic evidence suggests their device may have been targeted by nation-state-grade tools. The alerts don't specifically name Pegasus but describe "mercenary spyware attacks."

[IOC]
Pegasus forensic indicators (from Amnesty Tech MVT and Citizen Lab research): process names associated with Pegasus persistence include "bh" and various system-mimicking names; suspicious Pegasus-linked domains in iOS network logs include patterns like "[random].cdn[random].com" routing through specific ASNs associated with NSO infrastructure. Citizen Lab identified a network fingerprint they called "KISMET" for operator identification. Amnesty's Mobile Verification Toolkit (MVT) is the primary open-source forensic tool for Pegasus detection; it analyzes iOS device backups (via itunes-format backup) and Android forensic images for known IOCs including process names, domain lookups, and crash logs. Pegasus beacon intervals varied by operator; some used aggressive polling (every few minutes), others longer intervals to reduce network visibility. Known Pegasus C2 infrastructure used a distributed CDN-like architecture with short-lived domains, making IP-based blocking ineffective. The most reliable detection method is forensic analysis of iOS sysdiagnose archives or full filesystem extracts (requiring jailbreak or cooperative provider).