Visual Explainers
Technology and CyberComplexity: beginner

Pegasus Spyware

A mobile spyware tool at the center of global debates over surveillance, human rights, and cyber regulation

Pegasus is mobile spyware developed by NSO Group and reported in investigations involving journalists, activists, lawyers, political figures, and civil society targets, raising major concerns about state surveillance and spyware regulation.

Educational geopolitical infographic showing Pegasus spyware compromising a smartphone, with surveillance icons, encrypted message symbols, zero-click exploit warning signs, civil society targets, legal scales, and state surveillance regulation themes.
Pegasus spyware has become a global reference point in debates over mobile device compromise, state surveillance, human rights, and commercial spyware regulation.

Definition

Pegasus is a mobile spyware product developed by the Israeli company NSO Group. It is designed for use by government clients and has been reported in investigations involving the compromise of smartphones belonging to journalists, activists, lawyers, opposition figures, and other civil society actors.

Spyware of this kind can potentially access sensitive device data, communications, location information, microphones, cameras, and messaging content after a successful compromise. Pegasus became especially prominent because researchers linked some cases to zero-click exploitation, where a target may not need to open a malicious link.

NSO Group has stated that its products are intended to help governments investigate serious crime and terrorism. Human rights organizations, technology companies, and several governments have argued that commercial spyware can also enable unlawful surveillance, intimidation, and transnational repression when controls fail.

Why It Matters

Pegasus matters because smartphones are central to political life, journalism, diplomacy, activism, and legal work. A compromised phone can reveal sources, private communications, movements, contacts, documents, and strategy, creating risks that extend beyond the individual target.

The Pegasus debate also shows how cyber capabilities can be commercialized and exported across borders. This has made spyware regulation a major issue for human rights policy, export controls, corporate accountability, digital security, and relations between technology firms and governments.

GPS should monitor Pegasus as a reference case for commercial spyware, state surveillance, digital repression, and export-control debates. Key watch areas include sanctions or entity listings, litigation against spyware vendors, vulnerability disclosure, platform hardening by Apple and Google, international spyware principles, and cases involving journalists, activists, opposition figures, or diaspora communities.

Key Facts

Type
Commercial mobile spyware
Developer
NSO Group, an Israeli cyber intelligence company
Target devices
Smartphones, including iOS and Android devices depending on exploit availability
Reported capabilities
Potential access to messages, calls, location data, contacts, files, microphone, and camera after device compromise
Notable concern
Reported use against journalists, activists, lawyers, political figures, and civil society targets
Exploit issue
Some investigations have identified zero-click or low-interaction infection methods that reduce warning signs for targets
Policy relevance
Central to debates over spyware regulation, export controls, human rights safeguards, and state surveillance oversight
Assessment limit
Specific targeting claims can depend on forensic evidence, leaked data, litigation records, and official investigations

FAQ

What is Pegasus spyware?

Pegasus is mobile spyware developed by NSO Group. It is designed for government clients and can potentially compromise smartphones to access sensitive data, communications, location information, and device sensors after successful infection.

Why is Pegasus controversial?

Pegasus is controversial because investigations have reported its use against journalists, activists, lawyers, opposition figures, and civil society targets. Critics argue that commercial spyware can enable unlawful surveillance and undermine human rights when oversight is weak.

What is a zero-click exploit?

A zero-click exploit is a compromise method that does not require the target to click a link, open an attachment, or take an obvious action. This makes detection and prevention harder for both individuals and organizations.

Who makes Pegasus spyware?

Pegasus is developed by NSO Group, an Israeli cyber intelligence company. NSO Group has said its tools are intended for lawful government investigations into serious crime and terrorism, while critics point to reported misuse and insufficient safeguards.

Can Pegasus read encrypted messages?

End-to-end encryption protects messages while they travel between devices, but spyware that compromises the device itself may be able to access messages after they are decrypted on the phone. This is why device security is separate from message encryption.

How is spyware like Pegasus regulated?

Regulation can include export controls, sanctions or entity listings, procurement bans, litigation, human rights due diligence, and international principles on commercial spyware. The rules vary by country and remain an active policy debate.

Recent Developments

Sources6 references

Newsletter

Stay Ahead Of The Next Signal

Get briefings in your inbox when new analysis and reports are published.