PHONE SECURITY

What Is Pegasus Spyware? How It Works, Who It Targets, and How to Check Your Phone

Published 25 October 2026

Short answer: Pegasus is commercial spyware made by the Israeli company NSO Group and sold to government agencies. Once it's on a phone it can read messages (including those in encrypted apps), pull files and location, and switch on the microphone and camera. Its best-known infections needed no tap at all from the victim.

Our general guide to checking a phone for spyware covers stalkerware and the settings worth changing. This article goes deeper on Pegasus: how the exploits worked, what investigators found, where the court cases stand in October 2026, and how to check.

Who makes Pegasus

NSO Group is based in Israel and says it sells Pegasus only to governments for fighting crime and terrorism. In October 2025 the company confirmed that a group of US investors had taken controlling ownership, while its headquarters and main operations stayed in Israel. Under the new owners it has been lobbying to be taken off the US government's export blacklist (more on that below).

The government client picks the targets; NSO supplies the exploits and the infrastructure. That's why the victims tend to be journalists, lawyers, activists, opposition politicians and the people around them, not random members of the public.

How Pegasus gets onto a phone

Pegasus relies on security holes the phone maker doesn't yet know about (zero-days), delivered in three main ways.

Zero-click exploits

These are the attacks that made Pegasus famous. The attacker sends something to an app that processes it automatically, and a bug in that processing hands over control of the phone. The victim does nothing. Three have been documented in detail:

BLASTPASS worked against the newest iOS release at the time, iOS 16.6, and Citizen Lab and Apple's security team both said Lockdown Mode blocked it.

One-click links

The first Pegasus case to be documented, in 2016, started with a text message. Ahmed Mansoor, a human rights defender in the United Arab Emirates, received SMS messages promising "new secrets" about detainees tortured in UAE jails if he tapped a link. He sent them to Citizen Lab instead. The link led to a chain of three iPhone zero-days that would have taken over his phone, and Apple fixed them in iOS 9.3.5. Link-based attacks are cheaper than zero-click ones, and they still work on anyone who taps.

Network injection

Amnesty International documented a quieter method in Morocco in 2019, used against the journalist Omar Radi and the historian Maati Monjib. When they visited an ordinary website, their browser was silently redirected to an infection page. That needs control over the local mobile network, so it only works inside the country running the operation.

What Pegasus can access

Pegasus doesn't break encryption; it reads your data after your own apps have decrypted it. Apple's 2021 lawsuit said NSO's clients could turn on the microphone and camera of both iPhones and Android phones. Our main spyware guide lists the rest, from messages and location to the login tokens for your cloud accounts.

Amnesty found Pegasus processes running under names chosen to look like ordinary iOS services, such as "roleaboutd" and "msgacntd". Nothing shows on screen, which is why checking means examining the phone's records with a forensic tool.

Who it has targeted: the documented cases

The Pegasus Project, published on 18 July 2021, was the turning point. More than 80 journalists from 17 media organisations, co-ordinated by Forbidden Stories, worked from a leaked list of more than 50,000 phone numbers believed to have been selected by NSO clients in more than 50 countries. Being on the list didn't prove a phone was infected, so Amnesty International's Security Lab examined the phones of people who agreed to be checked. It confirmed infection or attempted infection in 37 phones, 85% of those it examined, and Citizen Lab peer-reviewed the method.

Among the findings:

• Pegasus was installed on the phone of Hatice Cengiz, the fiancée of murdered Saudi journalist Jamal Khashoggi, four days after his death.
• Journalists including Siddharth Varadarajan, founder of India's The Wire, and Szabolcs Panyi of Hungary's Direkt36 were among the confirmed victims.
• A fully updated iPhone 12 running iOS 14.6 was compromised in July 2021 through a zero-click attack. At that point, Amnesty concluded, NSO's clients could break into every recent iPhone model.

Citizen Lab's 2018 "Hide and Seek" report had already identified 36 separate Pegasus operators and 45 countries where they may have been conducting surveillance.

Lawsuits and sanctions: where things stand

WhatsApp v. NSO Group. WhatsApp sued NSO in a California federal court in October 2019 over the missed-call attack. The court found NSO liable in late 2024. In May 2025 a jury awarded WhatsApp US$444,719 in compensatory damages and US$167.3 million in punitive damages. In October 2025 Judge Phyllis Hamilton granted a permanent injunction barring NSO from targeting WhatsApp, and cut the punitive damages to about US$4 million. NSO has appealed the liability finding, the injunction and the damages to the US Court of Appeals for the Ninth Circuit. As of late October 2026 that appeal hasn't been decided.

Apple v. NSO Group. Apple sued NSO in November 2021, asking for a permanent ban on NSO using any Apple software, services or devices. In September 2024 Apple asked the court to dismiss its own case. It said it still believed in its claims, but that pressing on risked exposing the threat intelligence it uses to protect users. The court granted the dismissal in November 2024.

US Entity List. In November 2021 the US Commerce Department added NSO Group (and another Israeli spyware maker, Candiru) to its Entity List, saying their tools had been used to target government officials, journalists and activists. American companies need a licence to supply them, and applications are presumed to be refused. Reporting through 2026 describes NSO lobbying to be removed.

Does Pegasus work on Android?

Yes. Google and Lookout described an Android version, which Google named Chrysaor, in April 2017. It didn't need zero-days: it used a known rooting technique, and Google found it on fewer than three dozen devices, mostly in Israel. WhatsApp's lawsuit said Pegasus could be installed on Android, iOS and BlackBerry phones.

The reason almost every confirmed case involves an iPhone is that iPhones keep more of the records investigators need. Amnesty says plainly that stock Android leaves far fewer forensic traces. That makes Android infections harder to prove. It doesn't make Android phones safer.

Lockdown Mode and Advanced Protection

Both Apple and Google now offer a single switch for people who could be targeted.

Lockdown Mode on iPhone switches off the features zero-click attacks have relied on, including most message attachment types, link previews, and FaceTime calls from people you haven't called recently. BLASTPASS is the documented case of it stopping a real Pegasus exploit. We go through each restriction in our spyware guide.

Advanced Protection is Google's equivalent, introduced with Android 16. Among other things it:

• blocks app installs from outside the Play Store and keeps Play Protect on
• turns on memory tagging for supported apps, a hardware feature that catches many of the memory bugs exploits depend on
• restarts the phone automatically after 72 hours locked
• blocks 2G connections and adds USB protection
• offers optional Intrusion Logging, which keeps end-to-end encrypted security logs that investigators can examine later

A restart matters more than it sounds. It clears any spyware that only lives in memory, and it puts the phone back into its most locked-down state, as we explain in AFU vs BFU.

GrapheneOS goes further on exploit resistance, as we cover in GrapheneOS vs iPhone; it's what our PF Secured GrapheneOS phone runs.

Signs of Pegasus, and why they don't help much

Pegasus is designed not to show itself, so a warm phone or flat battery almost always has a more ordinary cause. The one signal worth acting on is a threat notification. Apple sends these to people it believes have been individually targeted by mercenary spyware, and says it has notified users in more than 150 countries since 2021. They appear on the iPhone's Lock Screen and in Settings, by email, and on your account page at account.apple.com. A genuine one will never ask you to tap a link, install anything or give your password. WhatsApp has sent similar warnings to people it found being targeted through its app.

How to check your phone for Pegasus

The standard tool is MVT, the Mobile Verification Toolkit, released by Amnesty's Security Lab in July 2021 alongside the Pegasus Project. It compares records from your phone with published traces of known spyware, including Pegasus. Our step-by-step MVT guide covers the iPhone and Android commands and what the results mean.

If you'd rather not use a command line, our free spyware scanner runs MVT's checks in your web browser. For an iPhone you point it at a backup made with Finder or Apple Devices. For Android you connect the phone by USB and use Chrome, Edge or Brave. Nothing is uploaded: the phone's data, your backup password and the report stay on your computer. The scanner page explains what it checks.

With any of these tools, a match is significant, but no match isn't proof: new campaigns aren't in the public indicators yet.

If you think you've been targeted

1. Don't factory reset or delete anything yet. That destroys the evidence an investigator needs.
2. Use a different, trusted device from now on, and change your important passwords from it.
3. Contact Access Now's Digital Security Helpline, which offers free help around the clock to journalists, activists and civil society, and aims to respond within two hours.
4. Or contact Amnesty International's Security Lab, which works with civil society on suspected spyware cases and has access to indicators that aren't public.

For an everyday baseline of settings, see our phone privacy checklist.

Pegasus isn't the only one

• Predator, sold by the Intellexa consortium, has been used against journalists and politicians. In 2023 Citizen Lab showed that former Egyptian MP Ahmed Eltantawy was targeted with it after he announced plans to run for president, partly through network injection on his mobile connection. In March 2024 the US Treasury sanctioned Intellexa, its founder Tal Dilian and associated companies.
• Graphite, made by Paragon Solutions, was forensically confirmed by Citizen Lab in June 2025 on the iPhones of European journalists, including Ciro Pellegrino of Italy's Fanpage.it. It used a zero-click iOS bug (CVE-2025-43200) that Apple fixed in iOS 18.3.1.

The lesson is the same for all three: update promptly, restart often, use Lockdown Mode or Advanced Protection if you could be a target, and get expert help if you're warned.

Privacy First sells GrapheneOS phones and makes the free spyware scanner mentioned in this article.

Run a free spyware check→

Keep reading

PHONE SECURITY

MVT: How to Check an iPhone or Android for Spyware

A plain-English guide to Amnesty's Mobile Verification Toolkit: what it checks, how to run it on iPhone and Android, and what the results mean.

Read article →

PHONE SECURITY

How to Check Your Phone for Spyware, and How to Stop It Getting On

What Pegasus-style spyware and stalkerware can do, how they get onto a phone, how to check yours with MVT, and the settings that make you a harder target.

Read article →

PHONE SECURITY

AFU vs BFU: Why Restarting Your Phone Protects Your Data

What Before First Unlock and After First Unlock mean, why forensic tools target phones in AFU, and how automatic reboot protects you.

Read article →