Leaked NSO Group documents reveal capabilities of its Pegasus spying software, with prices like $500K setup fee plus $650K to track 10 iPhone or Android users
SAN FRANCISCO — Want to invisibly spy on 10 iPhone owners without their knowledge? Gather their every keystroke, sound, message and location?
Context & Ripple Effects
This leak is the founding document of the modern commercial-spyware story: it turned NSO Group's Pegasus from rumor into a product with a published price list — $500K setup plus $650K per ten targets — sold to government buyers. Everything in the subsequent coverage builds on that disclosure.
Three years later, sources told the Financial Times that Pegasus could go beyond the phone itself, with claims it could scrape data from Apple, Google, Facebook, Amazon, and Microsoft cloud services via copied authentication keys and read tokens on infected devices. By 2021-2022 the secrecy was gone: Amnesty shipped a public scanning toolkit for iPhone and Android, and Citizen Lab's investigation found an infection inside UK No. 10, framing NSO as the lead player in a global industry.
First-order effects
- Government customers gain a menu-priced surveillance product targeting both iPhone and Android, making state-grade phone spying a procurement decision rather than a bespoke capability.
- Apple and Google become the named attack surface: the leaked capabilities target their devices' keystrokes, audio, messages, and location directly.
Second-order effects
- Cloud platforms are pulled into the blast radius — by 2019 NSO was telling buyers it could reach iCloud and other cloud accounts through infected phones, forcing Apple, Google, Facebook, Amazon, and Microsoft to treat spyware as a cloud-security problem, not just a device one.
- A defensive market emerges against the pricing transparency: Amnesty's public scanner gives potential victims a free countermeasure, shifting the arms race toward detectability.
Third-order effects
- The pattern points from covert vendor to accountable industry: Citizen Lab's No. 10 finding and the global-use investigation set up legal reckoning — NSO's continued WhatsApp targeting after Meta filed suit ended in a $167 million damages order.
- If surveillance stays this cheap and turnkey, device and cloud vendors' security postures harden structurally, with spyware firms facing regulatory and judicial pressure rather than operating in the shadows the 2016 leak exposed.
The trend: Commercial spyware is moving from a shadowy, invitation-only trade revealed by leaks to a litigated, publicly scanned industry where platform vendors and courts set the boundaries.