Investigation finds 65+ people were targeted by Pegasus and Candiru, including Catalans, likely by Spanish authorities, and details a new iOS zero-click, HOMAGE
Key Findings — The Citizen Lab, in collaboration with Catalan civil society groups, has identified at least 65 individuals targeted …
The Citizen Lab
Context & Ripple Effects
Citizen Lab had already documented ForcedEntry, an iMessage zero-click chain used against Bahraini targets; HOMAGE extends that record of spyware operators reaching iPhones without requiring a victim to interact with a message. The Catalan case also broadens the reporting from a single exploit to an alleged campaign involving both Pegasus and Candiru.
Later Citizen Lab reporting of new iOS 15 and early-iOS-16 zero-click hacks shows that the underlying contest did not end with one disclosed chain: researchers continued to identify new attack paths as Apple fixed prior flaws.
First-order effects
Spanish authorities are the investigation's likely operator attribution, putting their alleged use of Pegasus and Candiru against Catalans under immediate public and civil-society scrutiny.
The identified Catalan targets face the implications of a zero-click iOS compromise, while Citizen Lab's HOMAGE documentation gives defenders a concrete artifact to investigate.
Second-order effects
Apple and other device-security teams face a recurring response cycle: disclosed zero-click techniques create pressure to identify and close the affected attack surface, as later iPhone exploit fixes illustrate.
Pegasus and Candiru customers lose some operational secrecy when technical reporting links a campaign, its target set, and an exploit method, making subsequent targeting easier for researchers to recognize.
Third-order effects
Repeated reporting on zero-click Pegasus chains targeting journalists and later iPhone exploits points to commercial spyware becoming an enduring adversary for mobile-platform security rather than a one-off incident category.
If cross-border civil-society investigations continue to connect spyware deployments to state operators, accountability pressure will increasingly center on both the government customers and the vendors supplying the capability.
The trend: Commercial spyware campaigns are repeatedly exploiting zero-click mobile attack paths, with independent forensic research exposing both the technical chains and their alleged state use.
“If Spanish authorities are responsible, clandestinely eavesdropping on the opposite side of a negotiation, including in some cases their legal representatives or relatives, is a clear act of bad faith.” #CatalanGate https://citizenlab.ca/...
Victims included Members of the European Parliament, Catalan Presidents, legislators, jurists, and members of civil society organisations. Family members were also infected in some cases.
The Citizen Lab, in collaboration with Catalan civil society groups, has identified at least 65 individuals targeted or infected with mercenary spyware.
3/ Catalan civil society was extensively targeted. From the leadership of major civic organizations like @omnium & @assemblea_int...to open source developers working on digital voting. Mostly #Pegasus, but #Candiru spyware, too. Link: https://citizenlab.ca/... https://twitter.com…
Deaply shocked by this revelations incl. 2 of my colleagues @DianaRibaGiner and @jordisolef “The Citizen Lab is not conclusively attributing the operations to a specific entity but strong circumstantial evidence suggests a nexus with Spanish authorities” https://citizenlab.ca/...
Today it's been confirmed that the Catalan pro-independence movement is a victim of the largest case of illegal espionage in the world. #CatalanGate is a direct attempt against democracy and fundamental rights. We won't allow this cause to go unpunished. https://citizenlab.ca/...
We identified evidence of HOMAGE, a previously-undisclosed iOS zero-click vulnerability used by NSO Group that was effective against some versions prior to 13.2.
The Citizen Lab is not conclusively attributing the operations to a specific entity, but strong circumstantial evidence suggests a nexus with Spanish authorities.
BREAKING: we @citizenlab found signs of a #Pegasus spyware infection at the 🇬🇧Prime Minister's office, 10 Downing St. We notified 🇬🇧. We'd found other infections within the Gov.. THREAD 1/ Must-read by @RonanFarrow: https://www.newyorker.com/... https://twitter.com/...
4/ Who did it? We linked the @10DowningStreet #Pegasus case... to the United Arab Emirates. We connected the multiple @FCDOGovUK cases to: - 🇦🇪 #UAE - 🇮🇳 #India - 🇨🇾 #Cyprus - 🇯🇴 #Jordan Here's the statement by our director @RonDeibert https://citizenlab.ca/... https://twitter.co…
We also confirm that in 2020 and 2021 we observed and notified the UK Gov 🇬🇧 of multiple suspected instances of #Pegasus spyware infections within official UK networks, including @10DowningStreet & @FCDOGovUK https://citizenlab.ca/... https://twitter.com/...
Goodness, who would have thought it? A PM so notoriously careless he leaves his cell-phone number online for *years* after he becomes PM has overseen a government that has been hacked. Colour me astonished. https://twitter.com/...
I am one of the 65 pro-independence politicians, lawyers and journalists spied on with #Pegasus, a spyware that can only be acquired by states. #CatalanGate is the biggest technological political espionage case ever discovered in a democracy https://www.newyorker.com/...
3/ Many assumed that 🇬🇧's vaunted security apparatus could protect the government from the scourge of mercenary spyware like #Pegasus. Wrong. 🇬🇧 got spectacularly burned. So, which foreign governments might have hacked @10DowningStreet & @FCDOGovUK?
From a hacking at 10 Downing St to the world's biggest forensically documented spyware attack—I spent 2 years digging into the spyware industry, accessing its most notorious firm and the tech platforms warring against it, with your privacy in the balance: https://www.newyorker.co…
Ronan Farrow reports, using Citizen Lab analysis, that India was allegedly behind some of the Pegasus attacks on the UK Foreign Office. https://www.newyorker.com/... https://twitter.com/...
BREAKING: Major new @citizenlab report “CatalanGate” - extensive mercenary spyware operation against Catalans in Spain discovered https://citizenlab.ca/...
“In Catalonia, more than sixty phones—owned by Catalan politicians, lawyers, and activists in Spain and across Europe—have been targeted using Pegasus. This is the largest forensically documented cluster of such attacks and infections on record” https://www.newyorker.com/...