Leaked NSO Group documents reveal capabilities of its Pegasus spying software, with prices like $500K setup fee plus $650K to track 10 iPhone or Android users
SAN FRANCISCO — Want to invisibly spy on 10 iPhone owners without their knowledge? Gather their every keystroke, sound, message and location?
Context & Ripple Effects
This leak was the moment the Pegasus price list became public: a $500K setup fee and $650K per ten targets turned state-grade phone espionage into an itemized product with iPhone and Android both supported. Everything in the later record builds on that disclosure — by 2019, sources reported NSO told buyers it could go beyond the handset and scrape data from Apple, Google, Facebook, Amazon, and Microsoft clouds using copied authentication keys (cloud-scraping claims), with a companion report describing authentication-token theft on infected phones.
First-order effects
- Government buyers get a transparent menu for surveillance — capabilities (keystrokes, audio, messages, location) tied directly to per-target pricing, making procurement decisions concrete rather than speculative.
- Apple and Google are named as exploited platforms in the leaked materials, putting the burden on them to harden iOS and Android against exactly the intrusion paths now documented.
Second-order effects
- NSO's roadmap pushes past the device into cloud accounts via stolen authentication tokens, expanding each infection from one phone to every connected service the victim uses.
- Defenders industrialize in response: Amnesty International's public scanning toolkit lets any iPhone or Android owner check for Pegasus compromise, shifting detection from forensic labs to end users.
Third-order effects
- Citizen Lab's finding of a Pegasus infection inside UK No. 10 (global spyware investigation) shows the customer base extending from intelligence services to targets at the heart of allied governments, forcing spyware onto the diplomatic agenda.
- Legal accountability arrives through the platforms themselves — NSO's continued targeting of WhatsApp users after Meta sued led to a $167 million judgment, establishing that spyware vendors can be held liable in court rather than operating beyond reach.
The trend: Commercial spyware is scaling from per-device surveillance sold at listed prices to cloud-wide data access, while platform lawsuits and public forensics tools build the counterweight.