Research: Pegasus attacks on Mexican activists and reporters from 2019-2021 used 0-click exploits, after Mexico's president called Pegasus a thing of the past
Key Takeaways — Mexican digital rights organization R3D (Red en los Defensa de los Derechos Digitales) …
Context & Ripple Effects
R3D's finding lands in a country with the deepest documented Pegasus footprint: an earlier investigation traced how Mexico became the spyware's first client and most prolific user, and the attorney general's office has since opened a probe into a ~$23M purchase by the prior administration and whether NSO sold it legally.
The 2019-2021 window matters because it runs through the period when Mexico's president publicly dismissed Pegasus as a thing of the past — and the same zero-click technique R3D documents had already been caught hitting Al Jazeera reporters via iMessage in 2020. Later reporting showed the practice persisted, including the targeting of Alejandro Encinas while he investigated military abuses.
First-order effects
- Mexican activists and reporters now have forensic evidence that 0-click infections — which require no user interaction and leave victims no way to detect the attack — were used against them during 2019-2021, directly contradicting the president's public claim that Pegasus was retired.
Second-order effects
- The attorney general's investigation into the prior administration's purchase gains concrete deployment evidence, raising the legal question of whether NSO's sales to Mexico complied with the terms under which it was licensed.
- Apple's patch cycle becomes the de facto defense: Citizen Lab later documented NSO deploying at least three new zero-click hacks against iPhones on iOS 15 and early iOS 16 before Apple fixed the flaws, so Mexican targets' security depends on vendor fixes outpacing NSO's exploit chain.
Third-order effects
- If the pattern holds, commercial spyware operates as a standing instrument of state surveillance that survives changes in administration and public denials — with civil-society forensics groups like R3D and Citizen Lab serving as the only effective check on deployments governments officially claim to have ended.
The trend: Governments publicly disavow commercial spyware while procurement and deployment continue, leaving forensic researchers as the counterweight to official denials.