Sources: NSO Group claims it can read authentication tokens on phones infected with its spyware to access victims' data on iCloud and other cloud services
The Israeli company whose spyware hacked WhatsApp has told buyers its technology can surreptitiously scrape all of an individual's data …
Context & Ripple Effects
NSO Group's pitch to buyers has escalated sharply since its 2016 Pegasus price list sold per-target phone surveillance at $500K setup plus $650K for ten targets. Now, a day after sources reported the company told buyers it could copy authentication keys to scrape data from Apple, Google, Facebook, Amazon, and Microsoft clouds, the claim is that an infected phone's own session tokens hand over the cloud account — not just the handset.
The delivery mechanism is already proven: WhatsApp disclosed in May that a call-function flaw had let attackers install NSO spyware on iPhones and Androids since spring, now patched. The token-reading capability turns any single-device compromise into a standing claim on a victim's iCloud and other accounts, which is why the disclosure lands on Apple and the other cloud providers as much as on NSO itself.
First-order effects
- Buyers of NSO's Pegasus tooling gain a documented path from one compromised phone to victims' iCloud and other cloud-stored data, extending each target's exposure well beyond the device.
- Apple, Google, Facebook, Amazon, and Microsoft face immediate pressure to treat phone-level token theft as a cloud-account threat vector, since their authentication model is what NSO says it exploits.
Second-order effects
- Cloud providers are pushed toward shorter-lived or device-bound tokens and re-authentication prompts, raising friction for all users to blunt a capability marketed by one surveillance vendor.
- WhatsApp's patched call-function flaw shows the entry point matters as much as the payload — messaging platforms come under pressure to harden attack surfaces like voice calling that were never designed as malware vectors.
Third-order effects
- If phone compromise reliably yields cloud access, the security perimeter shifts from the device to the identity layer, forcing platform makers to assume endpoints are hostile and redesign trust around server-side verification.
- Commercial spyware priced openly in leaked documents, with source code theft already alleged in an Israeli indictment, points toward state-level scrutiny of an export market whose capabilities keep outrunning consumer platform defenses.
The trend: Commercial spyware is evolving from device-only surveillance toward full cloud-account access via stolen authentication tokens, forcing platform providers to rebuild identity trust around hostile endpoints.