Pegasus Spyware Victims: Documented Cases and the Global Impact of Zero-Click Surveillance

The Scope of Documented Targeting

The number of people confirmed to have been targeted or infected by Pegasus is far smaller than the number of phone numbers that have appeared on leaked lists. This distinction is the single most important methodological point for any researcher analyzing the Pegasus phenomenon. A number on a list is a candidate for targeting. A forensically confirmed infection is evidence.

This article surveys the documented cases and their evidentiary status, drawing on the Pegasus Project, Citizen Lab investigations, and subsequent national inquiries. It is written for researchers and journalists who need to distinguish confirmed findings from allegations.

The Pegasus Project Leaked List

In July 2021, Forbidden Stories and Amnesty International shared a leaked list of more than 50,000 phone numbers with a consortium of 17 media organizations. The list was believed to be a selection of numbers that had been entered into a system used by NSO Group clients to propose targets for surveillance. The numbers spanned 45 countries.

It is critical to understand what this list is and is not. It is not a list of confirmed infections. It is a list of numbers that clients selected for possible targeting. Amnesty's forensic analysis confirmed infections on a subset of devices belonging to list members, but the majority of list members could not be forensically tested. The list is evidence of the scale of interest in targeting. It is not evidence of the scale of infection.

Forensically Confirmed Cases

The following categories of targets have been forensically confirmed through device analysis.

Journalists. The most extensively documented cases involve journalists. Jamal Khashoggi's associates, including his wife Hatice Cengiz, were targeted by Pegasus in the period leading up to his murder in October 2018. Citizen Lab confirmed Pegasus on the device of Omar Abdulaziz, a Saudi dissident in Canada, whose conversations with Khashoggi were monitored. In Mexico, multiple journalists were confirmed infected, including Cecilio Pineda Birto, who was murdered weeks after being targeted.

Human rights defenders. Ahmed Mansoor, an Emirati human rights defender, was targeted in 2016 with an SMS containing a link that, when investigated by Citizen Lab and Lookout, revealed the first public knowledge of Pegasus. Mansoor did not click the link. The attempt itself was the discovery event.

Political opposition. In Spain, the CatalanGate investigation by Citizen Lab in 2022 documented Pegasus targeting of at least 65 individuals associated with the Catalan independence movement, including members of the European Parliament and the Catalan regional government.

Civil society. In El Salvador, Citizen Lab and Access Now documented in 2022 that at least 35 journalists and civil society members were targeted by a Pegasus operator.

The Evidentiary Standard

Every case above carries an evidentiary classification. Forensically confirmed means that a device was analyzed by a competent lab (Citizen Lab, Amnesty Security Lab, or equivalent) and artifacts consistent with Pegasus were found. Documented targeting means that a number appeared on a leaked list and contextual evidence supports the conclusion that it was selected for surveillance, but no device was forensically confirmed. Alleged means that a claim of targeting has been made without forensic confirmation or list inclusion.

Researchers should maintain these distinctions. Conflating them produces inaccurate reporting and undermines the credibility of the underlying evidence. The strength of the Pegasus research record is precisely that it has been built on forensic confirmation, not on allegation.

Government Responses

Governments have responded unevenly. India's Supreme Court ordered an independent investigation in 2021 after allegations of Pegasus use against journalists and politicians. The committee's report, released in 2022, was inconclusive. The European Parliament's PEGA Committee investigated spyware use across EU member states and adopted its final report in 2023, calling for stronger regulation. Hungary, Poland, and Spain were among the countries examined.

NSO Group has consistently denied that its products were used against the specific individuals identified in investigations, while maintaining that it cannot comment on the operations of its clients. This position, combined with the forensic evidence, defines the ongoing tension between the company's public statements and the documented record.

References

• Forbidden Stories, Pegasus Project, July 2021.
• Citizen Lab, CatalanGate, April 2022.
• Citizen Lab and Access Now, El Salvador Pegasus targeting, 2022.
• Citizen Lab, The Million Dollar Dissident, 2016.
• EU PEGA Committee, final report, 2023.