Pegasus in 2026
As of October 2026, Pegasus remains an active threat despite lawsuits, export controls, and global scrutiny. NSO Group has restructured, new exploit variants have been documented, and the commercial spyware industry has expanded. Here is the current state of Pegasus and the broader mercenary spyware landscape.
Last Verified 2026-10-01Author Pegasus Research ArchiveEditor Editorial Team
- 01Pegasus remains active in 2026 despite legal and regulatory pressure
- 02WhatsApp won a $167M verdict and permanent injunction against NSO in 2025; filed for contempt in June 2026
- 03Amnesty's 'Inside Pegasus' (July 2026) revealed NSO's active operational role via internal documents
- 04First-ever criminal conviction of spyware executives: Intellexa founder sentenced to 8 years (Greece, 2026)
- 05Apple Threat Notifications now reach 150+ countries; August 2026 batch hit 110 countries
- 06Citizen Lab documented Pegasus targeting of European Parliament members and Serbian activists in 2026
- 07The commercial spyware market has expanded with new vendors entering the space
- 08Apple and Google continue to patch vulnerabilities and improve detection capabilities
The Current Threat Landscape
As of October 2026, Pegasus remains an active and evolving threat. Despite the US Entity List designation, multiple lawsuits, and increased regulatory scrutiny, NSO Group continues to operate and its products continue to be used against targets worldwide.
Recent Exploit Developments (2024–2026)
| Exploit/Variant | Year | Vector | Platform | Status |
|---|---|---|---|---|
| LOCKDOWN-LESS | 2024 | iMessage variant | iOS 17 | Patched (iOS 17.4.1) |
| Chromium-based | 2025 | Browser exploit | Android | Patched |
| New iMessage variant | 2026 | iMessage | iOS 18 | Patched (iOS 18.3) |
NSO Group in 2026
NSO Group has undergone significant changes since the 2021 Pegasus Project:
- WhatsApp verdict and injunction (2025): A jury awarded WhatsApp $167M in damages and a permanent injunction was entered barring NSO from targeting WhatsApp ever again
- Contempt filing (June 2026): WhatsApp asked the court to hold NSO in contempt for violating the permanent injunction, citing continued NSO-linked spearphishing attempts and test account creation on WhatsApp
- Amnesty "Inside Pegasus" (July 2026): Amnesty International published its most complete analysis of Pegasus, based on internal NSO documents from the WhatsApp litigation, revealing NSO's active operational role through its "White Services" team, PATN, and 24/7 NOC
- Restructuring: The company has restructured its operations and ownership following the loss of Novalpina Capital's backing
- Entity List impact: The US Entity List designation has restricted NSO's access to US technology, forcing the company to find alternative suppliers
- Continued operations: Despite the restrictions and legal losses, NSO continues to develop and sell Pegasus to existing and new clients
- Market repositioning: NSO has sought to reposition itself as a responsible actor, calling for regulation of the spyware industry
The Broader Spyware Market
NSO Group is no longer the only player in the commercial spyware market. The industry has expanded significantly:
- Candiru: Israeli spyware vendor, also added to the US Entity List in 2021
- Cytrox: North Macedonian spyware vendor, added to the US Entity List in 2022
- Intellexa: A consortium of surveillance companies (including Cytrox) based in Greece
- Predator (Intellexa): A competing mercenary spyware product documented by Citizen Lab
- Quadream: Israeli spyware vendor, similar to NSO Group, documented in 2023
- Others: Multiple other vendors operate in the same space, often with less public scrutiny than NSO
A Growing Industry
The commercial spyware market has grown significantly since 2021. While NSO Group remains the most prominent vendor, the proliferation of competitors means that even if NSO were shut down, the technology and market would continue. The problem is industry-wide, not limited to one company.
Platform Defenses in 2026
Apple
- Lockdown Mode: Continues to be updated with new restrictions in each iOS release
- Threat Notifications (updated August 2026): Apple now sends notifications directly on the iPhone Lock Screen and in Settings, plus email from threat-notifications@email.apple.com. Has notified users in over 150 countries since 2021; August 2026 batch reached users in 110 countries
- Rapid Security Responses: Faster patching for critical vulnerabilities
- BlastDoor improvements: iMessage parsing continues to be hardened
- Sandbox improvements: Ongoing improvements to iOS sandboxing and exploit mitigations
- Google Play Protect: Enhanced scanning for spyware
- Android security patches: Monthly security updates continue
- Google TAG: Threat Analysis Group tracks state-sponsored attackers and mercenary spyware
- Android 15/16 security features: New privacy and security features in recent Android versions
Regulatory Landscape in 2026
- US Entity List: Remains in effect for NSO Group, Candiru, Cytrox, and Intellexa
- EU AI Act: The EU AI Act, which entered into force in 2024, includes provisions relevant to surveillance technology
- EU PEGA Committee recommendations: The PEGA Committee's recommendations have led to proposed EU legislation on spyware regulation
- National laws: Several countries have introduced or passed laws regulating or restricting the use of commercial spyware
- Export controls: Israel, the EU, and other jurisdictions have tightened export controls for surveillance technology
- UN guidance: The UN has issued guidance on the human rights implications of commercial spyware
- First criminal conviction of spyware executives (2026): A Greek court sentenced the founder of Intellexa and three others to 8 years in prison over the Greek spyware scandal — the first-ever criminal conviction of spyware company executives
- Spyware Accountability Initiative (SAI): Meta/WhatsApp announced a significant contribution to the SAI, supporting dozens of organizations worldwide focused on forensic research, user support, and advocacy
What Has Changed Since 2021
| Aspect | 2021 (Pegasus Project) | 2026 (Current) |
|---|---|---|
| NSO Group status | Active, Novalpina-owned | Restructured, lost WhatsApp case, continues operating |
| US Entity List | Added Nov 2021 | Still in effect |
| WhatsApp v. NSO | Lawsuit filed (2019) | $167M verdict (2025), contempt filing (2026) |
| Known exploit variants | ~7 documented | 11+ documented |
| Spyware vendors in market | Few (NSO dominant) | Many (NSO, Candiru, Cytrox, Intellexa, Quadream, etc.) |
| Apple Lockdown Mode | Not yet introduced | Active and evolving (iOS 16+) |
| Apple Threat Notifications | Email + iMessage | Lock Screen + Settings + email; 150+ countries |
| EU regulation | Minimal | EU AI Act + PEGA recommendations |
| Criminal convictions | None | Intellexa founder: 8 years (Greece, 2026) |
| NSO internal docs | Not public | Disclosed via WhatsApp litigation (Amnesty, 2026) |
| Public awareness | Post-Pegasus Project peak | Sustained but evolving |
| Detection tools | MVT released | MVT + improved platform tools |
Ongoing Challenges
- Zero-day arms race: As long as software has vulnerabilities, spyware vendors will find and exploit them
- Industry proliferation: New vendors continue to enter the market, often with less scrutiny than NSO
- Client accountability: Government clients of spyware vendors are rarely held accountable for misuse
- Detection limitations: Non-persistent infections remain difficult to detect
- Legal gaps: International law has not kept pace with the commercial spyware industry
- Victim support: Forensic analysis capacity remains limited compared to the scale of targeting
