Sources: NSO Group told buyers it can scrape users' data from cloud services of Apple, Google, Facebook, Amazon, and Microsoft by copying authentication keys
The Israeli company whose spyware hacked WhatsApp has told buyers its technology can surreptitiously scrape all of an individual's data …
Context & Ripple Effects
This lands two months after [[a:941622|WhatsApp disclosed that a call-function flaw let NSO Group install its surveillance software on iPhones and Android phones]], and a day before the Financial Times' follow-up on NSO reading authentication tokens on infected devices. The new claim extends the blast radius: one phone compromise becomes a key to iCloud, Google, Facebook, Amazon and Microsoft accounts.
It also reprices the product. Leaked 2016 documents put Pegasus at a $500K setup fee plus $650K per ten tracked users; if a single infection now yields cross-cloud data access, the value per tracked target multiplies without a new deployment.
First-order effects
- Pegasus buyers get a capability upgrade they did not have to redeploy for: an already-infected handset can be used to pull mail, files, messages and photos from five major cloud providers by copying authentication keys.
- Apple, Google, Facebook, Amazon and Microsoft now have their credential infrastructure implicated in a commercial spyware sales pitch, putting pressure on each to respond publicly or in court — where WhatsApp's litigation against NSO Group is already the venue.
Second-order effects
- Cloud providers are pushed to harden how tokens live on endpoints — treating a compromised phone as a compromised account — which raises engineering costs across the industry and may accelerate moves toward hardware-bound session credentials.
- Rival surveillance vendors must match the cross-cloud pitch or cede deals; the 2016 leaked price list becomes a floor for what governments pay, with token-harvesting as the differentiator.
Third-order effects
- If the pattern holds, the security perimeter shifts from the device to the identity: endpoint compromise equals total account compromise, forcing cloud platforms to assume hostile clients and redesign trust around server-side verification rather than stored keys.
- Commercial spyware consolidates around vendors who can sell whole-life access rather than single-app exploits, sharpening the regulatory question over exports of tools whose targets span every major US consumer cloud.
The trend: Commercial spyware is moving from surveilling devices to harvesting cloud identities, making the smartphone the master key to a target's entire digital life.