Pegasus Spyware
A mobile spyware tool at the center of global debates over surveillance, human rights, and cyber regulation
Pegasus is mobile spyware developed by NSO Group and reported in investigations involving journalists, activists, lawyers, political figures, and civil society targets, raising major concerns about state surveillance and spyware regulation.

Definition
Pegasus is a mobile spyware product developed by the Israeli company NSO Group. It is designed for use by government clients and has been reported in investigations involving the compromise of smartphones belonging to journalists, activists, lawyers, opposition figures, and other civil society actors.
Spyware of this kind can potentially access sensitive device data, communications, location information, microphones, cameras, and messaging content after a successful compromise. Pegasus became especially prominent because researchers linked some cases to zero-click exploitation, where a target may not need to open a malicious link.
NSO Group has stated that its products are intended to help governments investigate serious crime and terrorism. Human rights organizations, technology companies, and several governments have argued that commercial spyware can also enable unlawful surveillance, intimidation, and transnational repression when controls fail.
Why It Matters
Pegasus matters because smartphones are central to political life, journalism, diplomacy, activism, and legal work. A compromised phone can reveal sources, private communications, movements, contacts, documents, and strategy, creating risks that extend beyond the individual target.
The Pegasus debate also shows how cyber capabilities can be commercialized and exported across borders. This has made spyware regulation a major issue for human rights policy, export controls, corporate accountability, digital security, and relations between technology firms and governments.
GPS should monitor Pegasus as a reference case for commercial spyware, state surveillance, digital repression, and export-control debates. Key watch areas include sanctions or entity listings, litigation against spyware vendors, vulnerability disclosure, platform hardening by Apple and Google, international spyware principles, and cases involving journalists, activists, opposition figures, or diaspora communities.
Key Facts
- Type
- Commercial mobile spyware
- Developer
- NSO Group, an Israeli cyber intelligence company
- Target devices
- Smartphones, including iOS and Android devices depending on exploit availability
- Reported capabilities
- Potential access to messages, calls, location data, contacts, files, microphone, and camera after device compromise
- Notable concern
- Reported use against journalists, activists, lawyers, political figures, and civil society targets
- Exploit issue
- Some investigations have identified zero-click or low-interaction infection methods that reduce warning signs for targets
- Policy relevance
- Central to debates over spyware regulation, export controls, human rights safeguards, and state surveillance oversight
- Assessment limit
- Specific targeting claims can depend on forensic evidence, leaked data, litigation records, and official investigations
FAQ
What is Pegasus spyware?
Pegasus is mobile spyware developed by NSO Group. It is designed for government clients and can potentially compromise smartphones to access sensitive data, communications, location information, and device sensors after successful infection.
Why is Pegasus controversial?
Pegasus is controversial because investigations have reported its use against journalists, activists, lawyers, opposition figures, and civil society targets. Critics argue that commercial spyware can enable unlawful surveillance and undermine human rights when oversight is weak.
What is a zero-click exploit?
A zero-click exploit is a compromise method that does not require the target to click a link, open an attachment, or take an obvious action. This makes detection and prevention harder for both individuals and organizations.
Who makes Pegasus spyware?
Pegasus is developed by NSO Group, an Israeli cyber intelligence company. NSO Group has said its tools are intended for lawful government investigations into serious crime and terrorism, while critics point to reported misuse and insufficient safeguards.
Can Pegasus read encrypted messages?
End-to-end encryption protects messages while they travel between devices, but spyware that compromises the device itself may be able to access messages after they are decrypted on the phone. This is why device security is separate from message encryption.
How is spyware like Pegasus regulated?
Regulation can include export controls, sanctions or entity listings, procurement bans, litigation, human rights due diligence, and international principles on commercial spyware. The rules vary by country and remain an active policy debate.
Recent Developments
United States added NSO Group to the Entity List
The U.S. Department of Commerce added NSO Group to the Entity List, citing concerns that its spyware tools had been used to maliciously target government officials, journalists, businesspeople, activists, academics, and embassy workers.
U.S. Department of CommerceUnited States issued an executive order on commercial spyware
The U.S. government issued an executive order restricting federal use of commercial spyware that poses risks to national security or has been misused to target civil society, dissidents, journalists, or political figures.
The White HouseSources6 references
- U.S. Department of Commerce - Entity List Action
Official U.S. government action adding NSO Group to the Entity List over spyware-related concerns.
- The White House - Commercial Spyware Executive Order
Official U.S. policy restricting federal use of high-risk commercial spyware.
- Amnesty International Security Lab - Pegasus Project
Forensic methodology and civil society research on reported Pegasus infections and investigations.
- Citizen Lab - NSO Group Research
Research archive from an academic laboratory documenting spyware investigations, targeting patterns, and digital rights concerns.
- European Parliament - Pegasus Inquiry Committee
Institutional reference for European parliamentary scrutiny of Pegasus and equivalent surveillance spyware.
- Apple - Lockdown Mode
Platform security reference for high-risk users facing sophisticated digital threats, including mercenary spyware.
Newsletter
Stay Ahead Of The Next Signal
Get briefings in your inbox when new analysis and reports are published.