Pegasus

1,223 WhatsApp users in 51 countries were targeted with Pegasus in a 2019 campaign, anchoring coverage of NSO Group spyware in legal, security and export-control scrutiny.

Who they are

Pegasus is the commercial spyware product most closely associated in this coverage with Israel-based NSO Group. Stories treat it as a high-end mobile intrusion capability used by government customers against phones and messaging users, while Apple, WhatsApp, Citizen Lab and iVerify appear as the companies and researchers detecting, mitigating or litigating its use.

The recent arc

Coverage peaked in 2021 as revelations about state-sponsored spyware drove Apple to notify victims of attacks such as NSO’s ForcedEntry and commit $10 million to researchers, while Israel narrowed approved cyber-tool export destinations after US sanctions against NSO Group and Candiru. The central story then moved from exposure of Pegasus targeting to the institutional response by platforms, courts and governments.

Recent reporting has concentrated on Meta’s WhatsApp litigation and evidence of continuing reach: a US court document said Pegasus targeted 1,223 WhatsApp users in 51 countries in 2019, with Mexico accounting for 456 victims, and a judge found NSO Group liable over exploitation of WhatsApp. Detection reporting also persisted, with iVerify identifying 11 new iOS infections in December 2024. By April 2026, GCHQ framed Pegasus as part of a wider market in which roughly 100 countries have procured cyber-intrusion software and access barriers are falling.

The tension

The coverage repeatedly pits NSO Group and its government customers against communications and device-platform defenders, especially WhatsApp/Meta and Apple. NSO’s contention that Pegasus serves legitimate government use is pressured by court findings, reports of targeting across dozens of countries, and cases involving journalists, civil-society figures and the Meduza owner Galina Timchenko; the growing visibility of other vendors such as Paragon and QuaDream makes the issue broader than one supplier.

Why it matters

If the trajectory in this coverage holds, Pegasus matters less as an isolated NSO product than as a benchmark for a more accessible commercial intrusion market. Litigation, platform hardening and bounty programs may raise the cost of exploiting phones and messaging services, but GCHQ’s assessment and recurring infection findings suggest that enforcement and technical defenses will be tested by demand from a widening set of state buyers; how effectively vendors and their customers can be held accountable remains uncertain.

Related: NSO Group · Apple · WhatsApp · Israel · Mexico