Latest Pegasus News

On October 1, 2026, Amnesty International published a major investigation concerning surveillance practices in Morocco and the country's reported use of Pegasus. The investigation covered a 2017-2021 period and possibly later activity, documenting one-click attacks, zero-click attacks, and network injection allegations involving telecommunications infrastructure, with targets inside and outside Morocco. Government and agency denials or responses should be sought from official sources where available.

MVT (Mobile Verification Toolkit) is a collection of utilities developed by Amnesty International Security Lab to assist with mobile forensic analysis. It helps compare iOS forensic backups and Android diagnostic data against known indicators of compromise. MVT can help identify potential compromise but cannot definitively rule out infection in every case. It is intended for consensual digital forensics by qualified practitioners.

There is no simple consumer Pegasus scanner capable of definitively ruling out infection in every case. Sophisticated spyware tries to minimize evidence, forensic traces vary by exploit and version, and the absence of known indicators is not proof a device was never targeted or compromised. Detection typically requires specialist forensic analysis using tools such as MVT, correlation with known indicators of compromise, and expert interpretation.

In September 2026, former MEP and journalist Stelios Kouloglou filed a criminal complaint in Greece concerning Pegasus surveillance documented by Citizen Lab around October 2022 and March 2023. The complaint follows Citizen Lab's July 2026 disclosure. Citizen Lab did not publicly identify the responsible operator.

Apple Threat Notifications alert users who Apple believes may have been targeted by mercenary spyware. Apple has reported notifying targeted users in more than 150 countries since 2021. Apple states that legitimate threat notifications do not ask users to click unknown links, install applications, or provide passwords. Recipients should verify a notification through their Apple account directly and seek expert help.

The September 2026 Citizen Lab confirmation of an iMessage zero-click Pegasus infection against a Serbian student activist continues the documented progression of zero-click capability. The case illustrates that iMessage remains an attack surface despite Apple's BlastDoor mitigations, and that zero-click attacks against then-current iOS remain possible before vendor patches.

On September 2, 2026, Citizen Lab confirmed a Pegasus infection of a Serbian pro-democracy student activist. Forensic evidence was assessed with high confidence across December 2025 to January 2026. Citizen Lab assessed that an iMessage zero-click vector was used. The relevant vulnerability was subsequently patched as of iOS 18.4.1. SHARE Foundation and Citizen Lab reported that at least 14 civil-society, student, and opposition figures received Apple Threat Notifications. Citizen Lab did not publicly identify the responsible government operator.

Pegasus (NSO Group), Predator (Intellexa), and Graphite (Paragon) are distinct mercenary spyware families developed by different companies. Pegasus is the most extensively documented. Predator has been documented by researchers including Citizen Lab. Graphite has been reported in connection with various governments. Each has its own capabilities, operators, and evidentiary record, and they should not be conflated.

Pegasus is not exclusively an iPhone threat. Public documents and research, including Amnesty's 2026 analysis, describe Android capability. The 2019 WhatsApp zero-click attack affected both iOS and Android. Android forensic research has historically appeared less frequently in datasets, partly because shorter-lived forensic logs can make post-event investigation more difficult. Modern Android security developments include Advanced Protection, Intrusion Logging, and consensual digital forensics tools such as Android Quick Forensics.

Documented Pegasus capability has evolved from the 2016 one-click Trident chain (Ahmed Mansoor) through the 2019 WhatsApp zero-click attack, the 2020 KISMET iMessage zero-click, the 2021 FORCEDENTRY zero-click zero-day, the 2022 HOMAGE/FINDMYPWN/PWNYOURHOME chains, the 2023 BLASTPASS zero-click zero-day, to the 2025-2026 iMessage zero-click infection of a Serbian student activist. The progression shows a sustained shift toward zero-click delivery against then-current, fully patched devices before vendor fixes.

Amnesty International Security Lab's July 16, 2026 analysis described the Pegasus architecture using internal NSO documentation disclosed through the WhatsApp litigation. The analysis distinguishes customer-hosted components (dashboard, collection/storage) from vendor-managed delivery and anonymization infrastructure, describes 'whitened' infrastructure designed to minimize attribution, and a NOC monitoring technical/security alerts. NSO Group maintains that customers conduct surveillance operations and that NSO licenses technology to vetted governmental agencies.

On July 16, 2026, Amnesty International Security Lab published 'Inside Pegasus', an analysis of internal NSO documentation disclosed through the WhatsApp litigation. According to Amnesty's interpretation, customer-side systems include the Pegasus dashboard and collection/storage infrastructure; parts of delivery and anonymization infrastructure have historically been managed outside the customer environment; NSO documentation refers to anonymized or 'whitened' infrastructure; a Network Operation Center (NOC) is described as monitoring technical/security alerts; and infrastructure was designed to minimize attribution. NSO Group maintains that customers conduct surveillance operations and that NSO licenses technology to vetted governmental agencies for legitimate purposes.

In July 2026, Citizen Lab revealed that former MEP and journalist Stelios Kouloglou was infected with Pegasus. Forensic infection dates were assessed around 21 October 2022, 6 March 2023, and 7 March 2023. Kouloglou served on the European Parliament's PEGA committee, which investigated spyware use across member states. Citizen Lab did not publicly identify the responsible Pegasus operator. In September 2026, Kouloglou filed a criminal complaint in Greece concerning the surveillance.

In 2025, a US federal court issued a permanent injunction against NSO Group in the WhatsApp litigation, following a 2024 liability ruling. The 2025 jury damages proceedings produced an initial punitive damages award of approximately $167 million, subsequently reduced to $4 million. The injunction restrains NSO from certain conduct related to WhatsApp. In 2026, Meta sought to hold NSO in contempt for alleged violations.

In June 2026, Meta announced it was asking a federal court to hold NSO Group in contempt for alleged violation of the permanent injunction issued in 2025. Meta also said WhatsApp disrupted NSO-linked spear-phishing and social-engineering attempts. The 2026 Meta-reported campaign involved one-click social engineering, not zero-click. This distinction is important: the social-engineering attempts should not be labeled zero-click.