Documented Targeting Around the World

Azerbaijan has been associated with Pegasus targeting in research reports. Allegations should be presented with their evidentiary status.

Bahrain has been associated with Pegasus targeting in Citizen Lab research. Allegations should be presented with their evidentiary status.

Project Torogoz: Citizen Lab and Access Now reported 35 individuals and 37 devices targeted between July 2020 and November 2021, involving journalists and civil-society members, with KISMET and FORCEDENTRY and evidence of one-click links, zero-click infection, and data exfiltration.

Hungary has been the subject of Pegasus investigations documented by Direkt36 and Citizen Lab, including journalists and lawyers.

India has been the subject of multiple Pegasus investigations, including journalists and opposition figures. Research has continued through 2023 with additional journalist cases.

Jordan was identified in Citizen Lab's 2022 findings alongside El Salvador, with documented targeting of activists and civil-society figures.

Kazakhstan has been associated with Pegasus targeting in research reports. Allegations should be presented with their evidentiary status.

Mexico has been the subject of extensive Pegasus investigations, including journalists, human rights defenders, health advocates, and investigators of the 43 missing Ayotzinapa students. Multiple forensic examinations have confirmed infections.

Amnesty International Security Lab's October 2026 investigation reported surveillance practices in Morocco and the country's reported use of Pegasus, covering a 2017-2021 period and possibly later activity, including one-click and zero-click attacks and network injection allegations.

Poland has been the subject of Pegasus investigations, including opposition figures and activists.

Rwanda has been associated with Pegasus targeting in multiple reports. Allegations should be presented with their evidentiary status.

Saudi Arabia has been associated with Pegasus targeting in multiple reports, including the Pegasus Project dataset. Allegations should be presented with their evidentiary status.

A major 2026 page. Citizen Lab confirmed a Pegasus infection of a Serbian student activist with high-confidence evidence across December 2025 to January 2026, assessing an iMessage zero-click vector. SHARE Foundation and Citizen Lab reported at least 14 civil-society, student, and opposition figures notified via Apple Threat Notifications.

CatalanGate: Citizen Lab documented at least 65 individuals targeted or infected with Pegasus and/or Candiru, including 63 associated with Pegasus targeting/infection, covering politicians, lawyers, civil-society figures, and family members. In January 2026 Spain's High Court again closed its Pegasus investigation concerning surveillance of senior officials, citing lack of cooperation from Israel.

Thailand has been associated with Pegasus targeting in the Pegasus Project and related research. Allegations should be presented with their evidentiary status.

Togo has been associated with Pegasus targeting in research reports. Allegations should be presented with their evidentiary status.

The UAE was identified in early Pegasus research, including the 2016 Ahmed Mansoor case. Citizen Lab's 2018 research identified Pegasus infrastructure across 45 countries.