Pegasus & Spyware Glossary

Amnesty International's technical research unit, co-founder of the Pegasus Project and developer of MVT.

Apple's alert to users who may have been targeted by mercenary spyware. Apple has reported notifying users in more than 150 countries since 2021.

A defensive approach that limits the features and channels an attacker can target, exemplified by Apple's Lockdown Mode and BlastDoor.

The process of identifying the actor responsible for an attack. Attribution may be made with varying levels of confidence.

A 2023 zero-click, zero-day Pegasus exploit targeting PassKit/iMessage on iOS 16.6, patched in iOS 16.6.1.

Apple's security architecture for iMessage that processes untrusted data in a hardened, isolated environment, introduced in response to iMessage zero-click research.

See Command and Control.

Common Vulnerabilities and Exposures: a standardized identifier for publicly disclosed software vulnerabilities.

An interdisciplinary research laboratory at the University of Toronto's Munk School that has produced foundational Pegasus research.

Infrastructure used by operators to issue commands to compromised devices and receive exfiltrated data. Abbreviated C2.

A company that develops and sells surveillance capabilities, typically to government customers. Also called a mercenary spyware company.

Forensic examination of a device conducted with the informed consent of its owner, the standard approach for investigating suspected spyware infections.

A device such as a smartphone that is the target of surveillance. Endpoint compromise can expose data even when communications are encrypted in transit.

A US Commerce Department trade restriction list. NSO Group and Candiru were added on November 3, 2021, restricting access to US-origin items.

The unauthorized transfer of data from a compromised device to an attacker-controlled destination.

Code or a technique that takes advantage of a vulnerability to cause unintended behavior in software, often enabling unauthorized access or code execution.

A sequence of exploits combined to achieve a goal such as remote code execution and privilege escalation, often chaining multiple vulnerabilities.

A 2022-era Pegasus zero-click chain documented in Citizen Lab's Triple Threat research.

A 2021 zero-click, zero-day iMessage Pegasus exploit (CVE-2021-30860) captured by Citizen Lab and patched by Apple.

A non-profit journalism organization that coordinated the Pegasus Project collaboration.

A trace left on a device or in logs by an exploit or spyware, used by investigators to assess whether compromise occurred.

A zero-click capability identified during the CatalanGate research affecting older iOS versions.

Indicator of Compromise: an observable artifact (a file path, domain, configuration value) that suggests a system may have been compromised.

See IOC. Forensic evidence used to identify potential compromise.

Apple's messaging service, a documented attack surface for zero-click Pegasus exploits including KISMET, FORCEDENTRY, and BLASTPASS.

A 2020 iMessage zero-click Pegasus exploit chain active in the iOS 13 era, documented by Citizen Lab.

An exploit targeting the operating system kernel to gain privileged control over a device.

An optional Apple security setting that reduces attack surface by disabling or limiting high-risk features. It is not a guarantee of immunity.

Mobile Verification Toolkit: a collection of utilities to assist with mobile forensic analysis, developed by Amnesty International Security Lab.

An attack where an adversary intercepts or alters communications between parties, distinct from endpoint compromise.

Terminology used by Amnesty researchers in relation to FORCEDENTRY-era analysis.

Commercial surveillance software sold to government customers, often used in targeted operations. Pegasus is the most extensively documented example.

Israel-based company that develops and licenses Pegasus spyware to vetted governmental agencies. NSO states its technology is used for legitimate law-enforcement and national-security purposes.

An attack technique where malicious content is injected into network traffic to deliver an exploit, sometimes associated with telecommunications infrastructure.

An attack that requires the target to perform a single interaction, such as clicking a malicious link, to begin exploitation.

The European Parliament's committee of inquiry investigating the use of Pegasus and equivalent spyware, which issued 2023 recommendations.

A 2022 two-stage Pegasus attack involving HomeKit and iMessage according to Citizen Lab.

Apple's framework for Wallet/pass content; exploited by the BLASTPASS zero-click chain via malicious pass attachments delivered through iMessage.

The component delivered by an exploit that performs the intended malicious action, such as installing spyware.

Sophisticated mobile surveillance software developed by NSO Group and licensed to government intelligence and law-enforcement customers, capable of compromising smartphones and collecting sensitive information.

A 2021 collaborative investigation by Forbidden Stories, Amnesty International, and more than 80 journalists across 17 media organizations analyzing a leaked dataset of approximately 50,000 numbers selected as potential surveillance targets.

Gaining higher permissions on a device than intended, often a step in an exploit chain.

The ability of an attacker to run arbitrary code on a target device, often achieved through an exploit.

An exploit that breaks out of a restricted execution environment (sandbox) to access broader system resources.

Software designed to covertly monitor and collect information from a device.

A security alert from a vendor (e.g., Apple) informing a user they may have been targeted by mercenary spyware.

A 2016 one-click Pegasus exploit chain (CVE-2016-4657/4655/4656) targeting iOS via a malicious link, documented in the Ahmed Mansoor case.

The web browser engine used by iOS, historically a target for exploit chains including Trident.

An attack that begins without requiring the target to click a link, download an attachment, install an application, or knowingly interact with the attacker.

A vulnerability that is unknown to the vendor or for which no patch is yet available. Zero-day is distinct from zero-click: one concerns patch status, the other user interaction.