Pegasus spyware: its origins, real costs and who uses it

What Pegasus is — and why it is not ordinary malware

Pegasus is targeted surveillance spyware developed by the Israeli company NSO Group. Its stated commercial purpose is to help authorised intelligence and law-enforcement organisations investigate serious crime and terrorism. Yet technical and judicial investigations have documented surveillance directed at journalists, human-rights defenders, politicians and other people who were not accused of such crimes.

Pegasus is part of a surveillance platform combining intrusion methods, server infrastructure, analysts, operators and continuing technical support. In July 2026, Amnesty International reconstructed that system using internal NSO documentation disclosed in litigation brought by WhatsApp.

Once a device has been compromised, the system can potentially obtain information available on the phone and operate capture features. That is why messages protected by end-to-end encryption may still be exposed at the compromised endpoint. This does not mean that Pegasus mathematically breaks WhatsApp or Signal encryption.

How and why Pegasus emerged: NSO Group's origins

NSO Group Technologies Ltd. was established in Israel on 25 January 2010. Its founders were Niv Carmi, Shalev Hulio and Omri Lavie; their first initials form the name NSO. Privacy International documented the company’s corporate history.

The opportunity NSO identified was a market among public agencies wanting access to smartphones during investigations, especially as encrypted messaging became more widely used. NSO promoted this capability as a way to investigate serious crime. Over time, independent investigations also documented surveillance directed at journalists, activists and political figures.

In August 2016, the case of Ahmed Mansoor brought Pegasus to wider public attention. The UAE-based human-rights defender received suspicious text messages and forwarded them to researchers instead of opening the links. Citizen Lab and Lookout investigated a chain of three previously unknown vulnerabilities, called “Trident,” designed to compromise his iPhone. Mansoor did not open the links, so researchers documented an attempted infection stopped before the malicious link was followed. See Citizen Lab’s original report from 24 August 2016.

Who sells Pegasus? Governments, intermediaries and private operators

NSO Group says Pegasus is licensed to authorised government organisations under Israeli export controls. Commercial, legal and investigative records distinguish four functions that can be involved in a deployment:

1. Developer and technology supplier: NSO builds the system and supports key operating components.
2. Purchaser or end-user organisation: a public intelligence, security or investigative agency identified in the relevant agreement.
3. Private intermediary: a business involved in bidding, invoicing, reselling or installation that is not necessarily the organisation directing a surveillance operation.
4. Operator: the person or team using the system; identities and institutional relationships are not always public.

Investigations in Mexico identified the involvement of private companies alongside public agencies. In 2021, federal prosecutors identified KBH TRACK as a private operator and reported that the company had carried out telephone surveillance for various requesters whose identities had not yet been fully established for judicial purposes. The case illustrates why the manufacturer, contracting entities, operators and those directing surveillance must be distinguished.

Further context: Mexico's government on procurement and intermediaries (2021, Spanish) and coverage of federal prosecutors’ findings regarding KBH TRACK (2021, Spanish).

How much does Pegasus cost? Historical offers versus real contracts

The known price figures come from earlier commercial proposals and contracts. As of October 2026, no verified public price list establishes the cost of a new deployment. To interpret those figures, installation, licensing, maintenance and contracted services need to be considered separately.

A commercial proposal reported in 2016 referred to a $500,000 initial installation fee and $650,000 for capacity to target ten iPhones (a comparable bundle of ten Android targets was also reported). It mentioned annual maintenance of 17% of the total system price. Those amounts belong to that particular offer. Columbia Journalism Review discusses the reported offer. The 17% annual maintenance figure is also covered by The Indian Express (2021).

Ghana provides an example of how a contract's face value differs from payments documented to the technology supplier. A 2020 judgment considered an $8 million agreement involving the National Communications Authority and an intermediary. Court documents describe $4 million transferred to the intermediary, followed by a $1 million transfer to NSO. The different amounts show the role an intermediary could play in a particular procurement arrangement. High Court of Ghana judgment, 12 May 2020 (PDF).

What a Pegasus deployment includes: infrastructure, training and support

The licence alone does not explain the overall cost. NSO documents disclosed in the WhatsApp lawsuit and analysed by Amnesty International in 2026 describe customer-country servers and an analysis dashboard combined with delivery and relay infrastructure maintained by the supplier. NSO operated a network operations centre monitoring technical incidents and security alerts.

Services could include training, maintenance and updates. Contractual documents from 2015 linked to Ghana described four levels of technical support, ranging from routine problems to escalation to research-and-development engineers. Reporting has also documented NSO engineers working on customer premises in some arrangements. The scope of technical support and on-site assistance varied with the agreement. VICE's examination of the contracts.

Amnesty's July 2026 research highlights a continuing dependency: updates by Apple, Google or messaging providers can disable some infection techniques. Maintaining such a platform therefore requires ongoing development and technical support. Contracts may cover services and capabilities over years, not merely a software copy. Amnesty International Security Lab (2026).

How Pegasus can compromise iPhones and Android phones

Pegasus has used different techniques depending on the year, operating system and available vulnerabilities. Researchers have documented attacks requiring a person to open a link (one-click), some involving manipulated network traffic, and zero-click attacks that do not require the victim to tap a message or open an attachment.

In a zero-click attack, a vulnerability can be triggered by a device or service automatically processing particular content. The effectiveness of an attack depends on the particular vulnerability and the software version installed on the target device. Techniques change as suppliers fix vulnerabilities; an exploit described in 2018 should not be assumed to work on current iOS or Android releases. See Amnesty International's analysis of historical infection methods.

At a high level, the risk sequence is select a target → try to compromise the device → obtain data → maintain the surveillance system. This distinction helps explain the difference between an attempted attack and a completed infection.

What information Pegasus can obtain — and why encryption is not enough

Internal materials analysed by researchers describe potential access to messages, calls, email, contacts, photographs, calendar data, files, browsing information and location on a compromised phone. They also describe capabilities to activate a microphone or capture images, depending on a successful attack and the version deployed.

End-to-end encryption protects a message while it travels between participants. If an attacker can access the message on the device itself, before it is sent or after it is decrypted for display, that protection does not stop the compromise. The weakness lies in the compromised device; encryption still protects the message while it travels between participants.

Research published in 2026 also describes a potential path from collected credentials to attempts to access related accounts. The information available to an operator depends on the Pegasus version, the device and the vulnerabilities used in each attack. Source: Amnesty International Security Lab.

Documented timeline: Pegasus from 2010 to new findings in 2026

1. 2010. NSO Group established in Israel.
2. August 2016. Citizen Lab reports an attempted attack against Ahmed Mansoor and the “Trident” vulnerability chain.
3. 2021. The Pegasus Project brings together reporting and forensic research, distinguishing verified infections from numbers selected as possible targets.
4. 2022. Citizen Lab publishes CatalanGate, documenting spyware targeting and confirmed infections, while distinguishing technical findings from evidence about attribution.
5. January 2026. A Spanish judge provisionally closes an investigation into surveillance of government ministers because responsibility could not be established without judicial cooperation.
6. July 2026. Amnesty International releases new technical analysis of internal NSO materials disclosed during the WhatsApp proceedings.
7. 19 October 2026. Citizen Lab publishes high-confidence forensic findings of a Pegasus infection on the iPhone of the University of Belgrade's rector.

Sources: CatalanGate (2022); EFE, January 2026 (Spanish); Citizen Lab, October 2026.

Pegasus in Spain: investigated infections and unresolved attribution

It is important to distinguish different Spanish investigations. In 2022, the government disclosed infections detected on Prime Minister Pedro Sánchez's phone and those of several ministers. Spain's National Court investigated, but on 22 January 2026 ordered provisional closure again because of a lack of cooperation from Israel and difficulties identifying those responsible. Responsibility for those operations remained unresolved in the judicial investigation. EFE on the court decision.

Separately, Citizen Lab's CatalanGate report (2022) documented spyware targeting of Catalan civil-society and political figures, including forensically verified infections. The researchers identified circumstantial evidence suggesting connections to Spanish government entities, but stated that they were not conclusively attributing every operation to a particular government.

These are separate investigations involving different people and incidents. Conclusions about each operation depend on its own technical and legal evidence.

What is new in October 2026 — and what remains uncertain

Amnesty International's 16 July 2026 investigation provides new detail about the relationship between NSO and its customers: anonymised infrastructure operated by the supplier, local servers, analysis tools and technical support essential to the platform's operation. It also examines how internal demonstration records relate to material analysed in the original Pegasus Project.

On 19 October 2026, Citizen Lab and SHARE Foundation published high-confidence forensic findings that Vladan Đokić, Rector of the University of Belgrade, had his iPhone infected with Pegasus in a zero-click attack. Their report also says that Rade Bajić received an Apple threat notification. The infection of Đokić was supported by forensic analysis; for Bajić, the documented finding was Apple's threat notification, with the investigation still ongoing. Citizen Lab's original report.

The findings show that Pegasus remains an active targeted-surveillance concern. The vulnerabilities used, affected devices and attribution must be assessed case by case.

Can you tell if Pegasus is on your phone?

Unusual battery drain, heat and data usage have many common explanations. On their own, they cannot identify Pegasus. Likewise, an antivirus scan finding nothing does not establish that a device is free of sophisticated spyware.

Reliable investigations involve consensual digital forensics and campaign-specific technical indicators. Open-source tools such as Mobile Verification Toolkit (MVT) help trained specialists look for traces, but are not a definitive do-it-yourself test. Negative results cannot entirely rule out recent or previously unknown infections.

If you receive an Apple threat notification, verify it by visiting account.apple.com directly. Apple regards these notices as high-confidence warnings of targeted mercenary spyware but does not necessarily identify Pegasus or a specific country. Apple's guidance.

If your activities or circumstances put you at risk of advanced surveillance, seek trustworthy, consensual expert assistance. Access Now offers a Digital Security Helpline for civil society. Do not give your private phone data to unsolicited “recovery specialists”.

Reducing the risk on iPhone and Android

Apple explains that the vast majority of people will never face these unusually expensive, selective attacks. For most users, preventing common threats should remain the priority. People with a credible risk of targeted surveillance may require additional measures.

1. Install iOS, Android and app updates. Security patches can close exploited weaknesses. Check when your device's support period ends.
2. Secure your phone and accounts. Use a strong lock, multi-factor authentication and passkeys where available. These improve general security but do not substitute for patches.
3. Review links, permissions and installers. Avoid suspicious apps and configuration profiles. Remember that zero-click attacks may not involve any tap.
4. If you are at high risk on iPhone, consider Lockdown Mode. Apple designed it to restrict selected attack surfaces. It can interfere with normal features and does not guarantee absolute protection. Read our Lockdown Mode guide.
5. On Android, check updates and device compatibility. An unsupported handset handling sensitive information may need a replacement plan. Follow our ten essential Android security checks.
6. Take credible alerts seriously. Obtain help before erasing a potentially compromised phone, because valuable forensic evidence could be lost.

See also our iPhone essentials, passkeys guide and WhatsApp account protection. A VPN does not make a phone immune to Pegasus.

Frequently asked questions about Pegasus

Documentary sources, limits and review date

Editorial review: 30 October 2026. This report draws on historical commercial documents, forensic research, company statements and court decisions. Reported prices are tied to particular years and agreements. The infographics are original explanatory illustrations.

• Amnesty International Security Lab: internal documentation analysis (16 July 2026)
• Citizen Lab: Serbian cases (19 October 2026)
• Citizen Lab: attempted attack on Ahmed Mansoor (24 August 2016)
• Columbia Journalism Review: reported 2016 commercial terms
• VICE: contracts and customer support levels (2019)
• High Court of Ghana: procurement judgment (12 May 2020, PDF)
• Government of Mexico: procurement through intermediaries (2021, Spanish)
• EFE: provisional closure of the Spanish investigation (22 January 2026, Spanish)
• Apple: threat notifications and protections (2026)
• MVT: scope and limits of consensual device forensics
• Privacy International: NSO Group corporate history

For more verified guides, visit the RUSADIX Tools Security Center.