Pegasus Spyware That Hacked Phones

Picture a phone lying on a night table in a dark room. The screen is black, and the owner is asleep, sure the phone is asleep too. But inside that silent box, the camera could be awake. The microphone could be listening. Every message and password could be getting copied and sent to a stranger — and the phone would never buzz or glow to warn anyone. That is what Pegasus spyware was built to do.

What Pegasus spyware is

Pegasus is a spyware program built by an Israeli company called NSO Group. Spyware is software that secretly watches a device and reports back to whoever controls it. Plenty of cheap spyware exists on the internet, but Pegasus sits in a completely different league. It was designed to break into modern smartphones — both iPhones and Android phones — and to do it so quietly that the owner never notices anything strange.

NSO Group says it sells Pegasus only to governments, and only for fighting crime and terrorism: police and intelligence agencies use it to watch dangerous criminals who hide behind encrypted apps. That is the official story. But as later sections show, journalists and researchers have reported Pegasus on the phones of many people who are not criminals at all. NSO has denied those reports, and the fight over the truth has reached courtrooms.

One more thing makes Pegasus different. Using it reportedly costs governments enormous amounts of money, so each infection is precious to the attacker. This is not a virus sprayed at millions of random people. It is a carefully aimed weapon, fired at chosen targets one by one.

What Pegasus spyware can do inside a phone

Once Pegasus gets inside a phone, it behaves like an invisible guest who has been given every key in the house. According to security research, it can do all of the following:

• Read messages. It can see texts and emails, and also chats inside apps like WhatsApp and Signal. Encryption normally protects a chat while it travels across the internet. Pegasus does not need to break that protection, because it reads the messages on the phone itself, after they have been opened and unlocked. The locked box is opened from the inside.
• Steal passwords. As the owner types passwords and codes, Pegasus can record them and send them away.
• Listen and watch. It can switch on the microphone to hear conversations happening near the phone, and it can use the camera to see through the phone’s own eyes.
• Follow the owner. It can report the phone’s location, so the watchers know where the person goes, all day and all night.
• Copy the past. Old photos, contacts, call history and saved files can be pulled out too.

In short, the phone stops belonging to its owner. It becomes a tracking device that the owner carries everywhere and charges every night. Remember that quiet phone on the night table — nothing about it would look wrong, and that silence is exactly the point.

How Pegasus spyware reaches a phone

Most phone malware needs the victim to make a mistake: tap a bad link, install a fake app, type a password into a fake page. Pegasus became famous because it often needs none of that. It can arrive through what researchers call a zero-click attack.

A zero-click attack works like this. Every phone and every app has tiny flaws hidden in its code — mistakes nobody has found yet. Attackers craft a special message, sometimes sent through an app such as iMessage, that is built to trip over one of those hidden flaws the moment the phone processes it. The owner does not need to open the message, tap a link or even see it arrive. The phone quietly handles the message in the background, the flaw opens a door, and the spyware slips in. Then the message may even delete itself, leaving no trace the owner could spot.

Earlier versions did use links — its first famous appearance, told in the next section, began with text messages the target was meant to tap. Over the years the methods grew quieter, moving from “trick the person” to “the person never gets a chance to say no.”

The message that exposed Pegasus spyware

Pegasus became widely known in 2016 because of one careful man. Ahmed Mansoor, a human rights activist in the United Arab Emirates, received text messages that looked suspicious — they promised secrets and pushed him to tap the links inside. Many people would have tapped. Mansoor did something smarter. He did not touch the links, and instead he sent the messages to researchers at the Citizen Lab, a laboratory based in Toronto that studies digital spying.

The researchers examined the links and found something nobody expected: a professional spyware attack aimed at an iPhone, using hidden flaws even Apple did not know about. They identified it as Pegasus, from NSO Group, and Apple rushed out an emergency update to close the holes. A single forwarded message had pulled a secret hacking tool into the daylight — and the flaws it used were then fixed for millions of other people too.

The Pegasus Project and the leaked list

In 2021, the story grew much bigger. A group of journalists, working together with Amnesty International and an organisation called Forbidden Stories, published an investigation known as the Pegasus Project. They reported on a leaked list of about 50,000 phone numbers said to be of interest to clients of NSO — numbers that, according to the reporting, had been selected as possible targets.

The names connected to that list were startling. Journalists said it included numbers of reporters, activists and political figures. The French president Emmanuel Macron’s number was reported to be among them, which set off a political storm in France. If the reporting was right, a tool sold for chasing terrorists was also being pointed at people who report the news and question governments.

NSO Group strongly denied the reporting. The company said the list was not a list of its targets and repeated that Pegasus is meant only for investigations into serious crime and terrorism. Both sides of that argument matter, and readers should hold them side by side: researchers and journalists say they found evidence of Pegasus activity connected to such numbers, and the company says those conclusions are wrong.

WhatsApp takes Pegasus to court

Pegasus also ended up in a courtroom. In 2019, WhatsApp sued NSO Group, saying that about 1,400 of its users had been targeted through a flaw in WhatsApp’s calling feature. According to WhatsApp, the attack worked through its own app — a phone could be infected through the call system, again without the owner doing anything careless.

The case ran for years, and it did not end well for NSO. A United States court found the company liable, and in 2025 a jury awarded damages of about $167 million, as widely reported. The message was clear: spyware makers can be dragged into open court and made to answer for what their tools do.

How to protect your phone from spyware

Now the honest part. Pegasus is built for important targets: politicians, officials, journalists, activists and business leaders. Ordinary readers are not its usual prey, and living in fear of it would be wasted energy. But the habits that slow Pegasus down also protect everyone from ordinary phone malware, which is a real daily danger. So these steps are worth taking:

1. Install updates quickly. The hidden flaws Pegasus uses get closed by security updates. A phone that updates itself the moment a fix appears is a much harder target than one running old software. Turn on automatic updates for the phone system and for apps.
2. Restart your phone regularly. Security agencies have advised that restarting a phone about once a week can disrupt some kinds of spyware that live only in the phone’s temporary memory. It takes one minute, costs nothing and also keeps the phone running smoothly.
3. Be careful with links and attachments. Pegasus in its modern form may not need your tap, but almost every common phone scam and cheap spyware still does. If a message pushes you to tap urgently, slow down. Do what Ahmed Mansoor did: do not tap, and check the message another way.
4. Use Lockdown Mode if you are at high risk. In 2022, Apple introduced Lockdown Mode, a special setting that locks an iPhone down hard — blocking many attachments, links and connections — to protect the small number of people who face serious targeted attacks. Most people will never need it, because it makes the phone less convenient. But if your work puts you in real danger, it exists for you.
5. Watch for strange behaviour. A phone that overheats for no reason or drains its battery oddly fast deserves a check. The cause is usually innocent, but such signs are the only hints a spying phone ever gives.

I will be honest: the thought that a phone can be turned against its owner without a single tap is the part of this story that stays with me. These devices hold our whole lives, so keeping them updated and healthy is not a small chore — it is basic self-defence.

Common questions

Who makes Pegasus spyware?

Pegasus is made by NSO Group, a company based in Israel. NSO says it sells the tool only to governments and only for fighting serious crime and terrorism. Researchers and journalists have reported it being used against activists and reporters as well, which the company denies.

Can Pegasus spyware infect any phone?

In principle, it was built to infect both iPhones and Android phones. In practice, it is aimed at chosen, high-value targets rather than sprayed at random people, because using it is expensive and each attack is carefully prepared. An ordinary phone with updated software is a far less likely target.

How would I know if my phone has Pegasus?

Usually, you would not know. Pegasus is designed to leave no obvious signs, and checking for it properly requires specialist forensic tools of the kind used by laboratories like the Citizen Lab and Amnesty International’s Security Lab. Strange battery or data behaviour can be a hint, but it is not proof of anything on its own.

Does encryption protect my chats from Pegasus?

Encryption protects a message while it travels between phones, and it still matters a great deal. But Pegasus reads messages on the phone itself, where they sit unlocked for the owner to read. That is why it can see chats inside encrypted apps without breaking the encryption at all.

What should an ordinary person actually do?

Keep the phone and apps updated, restart the phone about once a week, and stay slow and suspicious around urgent links and attachments. Those steps will not make any phone invincible, but they block the cheap, common attacks that ordinary people actually face. People in genuinely high-risk work can add Apple’s Lockdown Mode for stronger protection.

Sources

• Wikipedia — Pegasus (spyware): https://en.wikipedia.org/wiki/Pegasus_(spyware)
• The Guardian — The Pegasus Project reporting: https://www.theguardian.com/news/series/pegasus-project
• Amnesty International — Forensic Methodology Report on Pegasus: https://www.amnesty.org/en/latest/research/2021/07/forensic-methodology-report-how-to-catch-nso-groups-pegasus/