Pegasus vs Other Spyware
Pegasus is the most prominent mercenary spyware, but it is not the only one. Competitors like Candiru, Predator (Intellexa), and Quadream offer similar capabilities. This page compares Pegasus with other commercial spyware products and with consumer-grade stalkerware.
- 01Pegasus is the most documented mercenary spyware but not the only one
- 02Competitors include Candiru, Predator (Intellexa/Cytrox), and Quadream
- 03Mercenary spyware differs from consumer stalkerware in cost, sophistication, and target profile
- 04All mercenary spyware vendors face similar legal and regulatory pressure
- 05The commercial spyware market has expanded significantly since 2021
Types of Spyware
It is important to distinguish between different categories of surveillance software:
- Mercenary spyware: Commercial products sold to governments for intelligence and law-enforcement. Extremely sophisticated, very expensive (often $millions per license), zero-click capable. Examples: Pegasus, Predator, Candiru.
- Stalkerware: Consumer-grade surveillance apps sold (often covertly) for monitoring partners, family members, or employees. Less sophisticated, much cheaper, typically requires physical access to the target device. Examples: mSpy, FlexiSPY, Cocospy.
- Lawful intercept: Telecommunications-level surveillance systems used by law enforcement with legal authorization. Operates at the network level, not the device level. Examples: SS7-based systems, IMSI catchers (Stingrays).
- Nation-state malware: Custom-built malware developed by intelligence agencies (not sold commercially). Examples: Stuxnet, Equation Group tools, Fancy Bear implants.
Mercenary Spyware Comparison
| Product | Vendor | Country | Zero-Click | US Entity List | Key Documentation |
|---|---|---|---|---|---|
| Pegasus | NSO Group | Israel | Yes | Yes (2021) | Citizen Lab, Amnesty, Pegasus Project |
| Candiru | Candiru | Israel | Yes | Yes (2021) | Citizen Lab (2021) |
| Predator | Intellexa/Cytrox | Greece/N. Macedonia | Yes | Yes (2022) | Citizen Lab, Google TAG |
| Quadream | Quadream | Israel | Yes | No | Calcalist (2023), Citizen Lab |
| KingsPawn | Unknown | Unknown | Reported | No | Limited public documentation |
Pegasus vs Predator (Intellexa)
| Aspect | Pegasus (NSO) | Predator (Intellexa) |
|---|---|---|
| Vendor country | Israel | Greece / North Macedonia |
| Founded | 2010 | 2019 (Intellexa consortium) |
| Primary vector | iMessage (iOS) | Browser exploit / single-use links |
| Zero-click | Yes (documented) | Yes (documented) |
| iOS targeting | Extensive | Yes |
| Android targeting | Yes | Yes |
| US Entity List | Yes (Nov 2021) | Yes (2022) |
| Documented victims | 50,000+ selected, many confirmed | Multiple confirmed |
| Key researcher | Citizen Lab, Amnesty | Citizen Lab, Google TAG |
Predator is Intellexa's flagship spyware product. Like Pegasus, it can compromise both iOS and Android devices through zero-click and one-click attacks. Predator has been documented targeting journalists, politicians, and activists, particularly in countries where Intellexa's clients operate.
Pegasus vs Candiru
| Aspect | Pegasus (NSO) | Candiru |
|---|---|---|
| Vendor country | Israel | Israel |
| Primary vector | iMessage, WhatsApp | Web exploits, spear-phishing |
| Zero-click | Yes (documented) | Yes (documented) |
| US Entity List | Yes (Nov 2021) | Yes (Jul 2021) |
| Documented victims | Journalists, activists, politicians | Journalists, activists, dissidents |
| Key researcher | Citizen Lab, Amnesty | Citizen Lab (2021) |
Candiru is an Israeli spyware vendor that was added to the US Entity List in July 2021, before NSO Group. Citizen Lab documented Candiru's spyware targeting journalists, activists, and political dissidents in multiple countries. Candiru's product is sometimes referred to as "DevilsTongue."
Mercenary Spyware vs Stalkerware
| Aspect | Mercenary Spyware (Pegasus) | Stalkerware (mSpy, FlexiSPY) |
|---|---|---|
| Buyer | Governments | Individuals |
| Cost | $millions per license | $10–$100/month |
| Target profile | Journalists, activists, politicians | Partners, family members, employees |
| Zero-click | Yes | Typically no (requires physical access) |
| Sophistication | Extremely high (zero-day exploits) | Low to moderate |
| Detection difficulty | Very hard | Moderate (visible in app list sometimes) |
| Legal status | Restricted/regulated | Often illegal (banned in some jurisdictions) |
| Scale | Hundreds of targets per client | Millions of devices worldwide |
While Pegasus receives the most media attention, stalkerware affects far more people worldwide. Stalkerware apps are used by abusers to monitor partners, ex-partners, and family members without their consent. These apps are illegal in many jurisdictions and are a form of domestic abuse. If you suspect stalkerware, contact a domestic violence support organization.
Why Pegasus Gets the Most Attention
- First to be widely documented: Pegasus was the first mercenary spyware to be forensically confirmed against civil society (Trident, 2016)
- Pegasus Project (2021): The largest collaborative investigation into any spyware product, with 80+ journalists and 17 media organizations
- Scale of targeting: 50,000+ numbers on the leaked list, including journalists, politicians, and heads of state
- High-profile victims: Associates of Jamal Khashoggi, Mexican journalists, Catalan politicians, Polish and Hungarian opposition figures
- Legal action: Major lawsuits from WhatsApp and Apple; US Entity List designation
- NSO Group's prominence: NSO is the largest and most visible spyware vendor, making it a focal point for scrutiny
The Proliferation Problem
The commercial spyware market has expanded significantly. Even if NSO Group were shut down tomorrow, the technology, expertise, and market demand would continue with other vendors. The problem is industry-wide: regulation, export controls, and accountability must address the entire market, not just one company.
New vendors continue to emerge, often with less public scrutiny than NSO Group. Some operate from jurisdictions with fewer export controls. The cat-and-mouse game between spyware vendors and platform vendors (Apple, Google) continues, with each new exploit discovery followed by a patch, followed by the discovery of a new exploit.
First Criminal Conviction of Spyware Executives (2026)
In 2026, a Greek court issued the first-ever criminal conviction of spyware company executives. The founder of Intellexa and three others were sentenced to 8 years in prison over the Greek spyware scandal involving Predator spyware. The case was built on forensic evidence and investigative reporting by civil society organizations including Citizen Lab.
This conviction sets a precedent for criminal accountability of spyware vendors and represents a significant milestone in the global fight against mercenary spyware.
Source: Citizen Lab, "Intellexa Founder, Three Others Sentenced to 8 Years in Prison Over Greek Spyware Scandal," 2026 (CL-2026-INTELLEXA)
