Pegasus is spyware created by the Israeli cyber-arms company NSO Group that is designed to be covertly and remotely installed on mobile phones running iOS and Android. While NSO Group markets Pegasus as a product for fighting crime and terrorism, governments around the world have routinely used the spyware to surveil journalists, lawyers, political dissidents, and human rights activists. The sale of Pegasus licenses to foreign governments must be approved by the Israeli Ministry of Defense.
As of September 2023, Pegasus operators were able to remotely install the spyware on iOS versions through 16.6 using a zero-click exploit. While the capabilities of Pegasus may vary over time due to software updates, Pegasus is generally capable of reading text messages, call snooping, collecting passwords, location tracking, accessing the target device's microphone and camera, and harvesting information from apps. The spyware is named after Pegasus, the winged horse of Greek mythology.
Cyber watchdog Citizen Lab and Lookout Security published the first public technical analyses of Pegasus in August 2016 after they captured the spyware in a failed attempt to spy on the iPhone of human rights activist Ahmed Mansoor. Subsequent investigations into Pegasus by Amnesty International, Citizen Lab, and others have garnered significant media attention, including in July 2021 with the release of the Pegasus Project investigation, which centered on a leaked list of 50,000 phone numbers reportedly selected for targeting by Pegasus customers.
Background NSO Group developed its first iteration of Pegasus spyware in 2011. The company states that it provides "authorized governments with technology that helps them combat terror and crime." NSO Group has published sections of contracts which require customers to use its products only for criminal and national security investigations and has stated that it has an industry-leading approach to human rights.
Discovery Pegasus' iOS exploitation was identified in August 2016. Emirati human rights defender Ahmed Mansoor received a text message promising "secrets" about torture happening in prisons in the United Arab Emirates by following a link. Mansoor sent the link to Citizen Lab of the University of Toronto, which investigated, with the collaboration of Lookout, finding that if Mansoor had followed the link it would have jailbroken his phone and implanted the spyware into it, in a form of social engineering.
Citizen Lab and Lookout discovered that the link downloaded software to exploit three previously unknown and unpatched zero-day vulnerabilities in iOS. According to their analysis, the software can jailbreak an iPhone when a malicious URL is opened. The software installs itself and collects all communications and locations of targeted iPhones. The software can also collect Wi-Fi passwords. The researchers noticed that the software's code referenced an NSO Group product called "Pegasus" in leaked marketing materials. Pegasus had previously come to light in a leak of records from Hacking Team, which indicated the software had been supplied to the government of Panama in 2015. Citizen Lab and Lookout notified Apple's security team, which patched the flaws within ten days and released an update for iOS. A patch for macOS was released six days later.
Regarding how widespread the issue was, Lookout explained in a blog post: "We believe that this spyware has been in the wild for a significant amount of time based on some of the indicators within the code" and pointed out that the code shows signs of a "kernel mapping table that has values all the way back to iOS 7" (released 2013). The New York Times and The Times of Israel both reported that it appeared that the United Arab Emirates was using this spyware as early as 2013. It was used in Panama by former president Ricardo Martinelli from 2012 to 2014, who established the Consejo de Seguridad Pública y Defensa Nacional (National Security Council) for its use.
Chronology Several lawsuits outstanding in 2018 claimed that NSO Group helped clients operate the software and therefore participated in numerous violations of human rights initiated by its clients. Two months after the murder and dismemberment of The Washington Post journalist Jamal Khashoggi, a Saudi human rights activist, in the Saudi Arabian Consulate in Istanbul, Turkey, Saudi dissident Omar Abdulaziz, a Canadian resident, filed suit in Israel against NSO Group, accusing the firm of providing the Saudi government with the surveillance software to spy on him and his friends, including Khashoggi.
In February 2024, a US court ordered NSO Group to hand over the code for Pegasus to WhatsApp as part of an ongoing lawsuit filed by the Meta Platforms-owned communication app related to the alleged use of Pegasus against WhatsApp users.
In September 2024, Apple announced its intention to drop its court appeal against NSO. The company argued that the most critical files about the spyware tool might never be disclosed, while Apple's own disclosures could aid NSO and similar companies. Another reason cited was a US ban on doing business with NSO, and a perceived boost to Apple's threat detection technologies in the three years since the claim was first filed. In December 2024, a US court ruled that NSO Group was liable for hacking 1,400 WhatsApp users' devices through Pegasus. The judge determined the NSO Group violated the Computer Fraud and Abuse Act, California Comprehensive Computer Data Access and Fraud Act, and WhatsApp's terms of service.
Technical details
The spyware can be installed on devices running certain versions of iOS—Apple's mobile operating system—as well as some Android devices. Rather than being a specific exploit, Pegasus is a suite of exploits that uses many vulnerabilities in the system. Infection vectors include clicking links, the Photos app, the Apple Music app, and iMessage. Some of the exploits Pegasus uses are zero-click — that is, they can run without any interaction from the victim. Once installed, Pegasus has been reported to be able to run arbitrary code, extract contacts, call logs, messages, photos, web browsing history and settings, as well as gather information from apps including but not limited to communications apps iMessage, Gmail, Viber, Facebook, WhatsApp, Telegram, and Skype.
In April 2017, after a Lookout report, Google researchers discovered Android malware "believed to be created by NSO Group Technologies" and named it Chrysaor (Pegasus' brother in Greek mythology). According to Google, "Chrysaor is believed to be related to the Pegasus spyware". At the 2017 Security Analyst Summit held by Kaspersky Lab, researchers revealed that Pegasus was available for Android in addition to iOS. Its functionality is similar to the iOS version, but the mode of attack is different. The Android version tries to gain root access (similar to jailbreaking in iOS); if it fails, it asks the user for permissions that enable it to harvest at least some data. At the time Google said that only a few Android devices had been infected.
Pegasus hides itself as far as possible and self-destructs in an attempt to eliminate evidence if unable to communicate with its command-and-control server for more than 60 days, or if on the wrong device. Pegasus can also self-destruct on command. If it is not possible to compromise a target device by simpler means, Pegasus can be installed by setting up a wireless transceiver near a target device, or by gaining physical access to the device.
Development of capabilities The earliest version of Pegasus – which was identified in 2016 – relied on a spear-phishing attack which required the target to click a malicious link in a text message or email.
As of August 2016, according to a former NSO employee, the U.S. version of Pegasus had 1-click capabilities for all phones apart from old Blackberry models which could be infiltrated with a 0-click attack.
In 2019, WhatsApp revealed Pegasus had employed a vulnerability in its app to launch zero-click attacks (the spyware would be installed onto a target's phone by calling the target phone; the spyware would be installed even if the call was not answered).
Since 2019, Pegasus has come to rely on iPhone iMessage vulnerabilities to deploy spyware.
By 2020, Pegasus shifted towards zero-click exploits and network-based attacks. These methods allowed clients to break into target phones without requiring user interaction.
Vulnerabilities Lookout provided details of the three iOS vulnerabilities: CVE-2016-4655: Information leak in kernel – A kernel base mapping vulnerability that leaks information to the attacker allowing them to calculate the kernel's location in memory. CVE-2016-4656: Kernel memory corruption leads to jailbreak – 32 and 64 bit iOS kernel-level vulnerabilities that allow the attacker to secretly jailbreak the device and install surveillance software – details in reference. CVE-2016-4657: Memory corruption in the webkit – A vulnerability in the Safari WebKit that allows the attacker to compromise the device when the user clicks on a link. Google's Project Zero documented another exploit, dubbed FORCEDENTRY, in December 2021. According to Google's researchers, Pegasus sent an iMessage to its targets that contained what appeared to be GIF images, but which in fact contained a JBIG2 image. A vulnerability in the Xpdf implementation of JBIG2, re-used in Apple's iOS phone operating software, allowed Pegasus to construct an emulated computer architecture inside the JBIG2 stream which was then used to implement the zero-click attack. Apple fixed the vulnerability in iOS 14.8 in September 2021 as CVE-2021-30860.
As of July 2021, Pegasus likely uses many exploits, some not listed in the above CVEs.
Pegasus Anonymizing Transmission Network Human rights group Amnesty International reported in the 2021 investigation that Pegasus employs a sophisticated command-and-control (C&C) infrastructure to deliver exploit payloads and send commands to Pegasus targets. There are at least four known iterations of the C&C infrastructure, dubbed the Pegasus Anonymizing Transmission Network (PATN) by NSO group, each encompassing up to 500 domain names, DNS servers, and other network infrastructure. The PATN reportedly utilizes techniques such as registering high port numbers for their online infrastructure as to avoid conventional internet scanning. PATN also uses up to three randomised subdomains unique per exploit attempt as well as randomised URL paths.
Detecting Pegasus Due to the covert nature of its installation, Pegasus was previously only able to be detected via digital forensics. On January 16, 2024, Kaspersky Labs announced in a press release a new method of detecting the spyware for iOS devices that involved inspecting the shutdown.log file, which logs reboot events, for indicators of compromise. Kaspersky developed a tool that extracts, analyzes, and parses the shutdown.log file to ease the process of locating the malicious signature. This method is only effective if the device is rebooted on the same day that it is infected with Pegasus.
Amnesty International released an open-source utility called Mobile Verification Toolkit that's designed to detect traces of Pegasus. The software runs on a personal computer and analyzes data including backup files exported from an iPhone or Android phone.
By country
Although Pegasus is stated as intended to be used against criminals and terrorists, it has also been used by both authoritarian and democratic governments to spy on critics and opponents. A UN special rapporteur on freedom of opinion found that the use of the spyware by abusive governments could "facilitate extrajudicial, summary or arbitrary executions and killings, or enforced disappearance of persons."
Armenia