Pegasus, cut open

By Ali AlQattan. Technical breakdown for developers and technical readers.

TL;DR

Pegasus is commercial spyware built by Israel's NSO Group that turns a patched-looking iPhone or Android phone into a remote listening device with no visible trace (Wikipedia). It infects phones through one-click links (early days) and increasingly zero-click attacks that need no tap at all — a missed WhatsApp call or a silently processed iMessage attachment — then reads messages before encryption, steals photos, passwords and location, and can switch on the microphone and camera (Scientific American, Council of Europe). You cannot reliably detect it yourself: the only serious public method is a forensic scan with Amnesty International's Mobile Verification Toolkit (MVT) against known indicators of compromise, ideally with expert help (Amnesty Security Lab). The only measure publicly credited with blocking real Pegasus attacks is keeping the phone fully patched plus enabling Apple's Lockdown Mode on iPhone — researchers state they have seen no successful mercenary-spyware compromise with Lockdown Mode enabled at the time of attack (MacRumors, TechCrunch). Everything below expands each claim with commands and references.

1. What Pegasus is (and isn't)

Pegasus is the flagship product of NSO Group, an Israeli cyber-arms vendor founded around 2010. NSO says it sells only to vetted governments for crime and counterterrorism, with each sale subject to Israeli export licensing (Wikipedia). In practice, forensic investigations and a 2021 leak of 50,000 candidate phone numbers showed targeting of journalists, activists, lawyers, executives, politicians and heads of state across dozens of countries (CPJ, UN News, OCCRP).

Three points matter for a technical reader. First, Pegasus is not an app you install and not a virus that spreads — it is a targeted implant: an operator picks one phone number and the infrastructure throws one or more exploits at that phone until code runs. Second, it is platform-native: there are iOS and Android variants, and capabilities shift with each OS release, but the goal is the same — silent privileged code execution plus a modular surveillance payload (Wikipedia, Norton). Third, the business model is exploit subscription: when Apple or Google patches one entry point, NSO burns another zero-day. That is why the story repeats every year with new CVE numbers but the same shape — parser bug in a message handler, sandbox escape, kernel privilege escalation, cleanup of traces.

Scale, for the record: Citizen Lab's internet scanning tied Pegasus infrastructure to operations in 45 countries (Citizen Lab); Amnesty/Citizen Lab forensics have confirmed journalist targeting in at least 18 countries (Amnesty); the 2019 WhatsApp attack alone hit 1,400+ phones in two weeks (Bloomberg Law); and abuse continues into 2025, e.g. two Serbian BIRN journalists targeted via Viber messages in February 2025 (Amnesty).

2. How infection works

2.1 Delivery: one-click to zero-click

Early Pegasus (2016, the UAE case against Ahmed Mansoor) arrived as an SMS promising "new secrets about torture" with a link. Mansoor forwarded it to Citizen Lab instead of tapping; lab analysis found the Trident chain — three iOS zero-days that would have jailbroken his iPhone 6 on click (Citizen Lab, Wikipedia). One-click still exists, but the product moved to zero-click: no tap, no call answered, often no visible notification. Two confirmed vectors define the genre. In 2019, a WhatsApp voice-call bug (CVE-2019-3568) let attackers inject code with a call the victim never answered (Citizen Lab). From 2020 on, iMessage became the favored path: KISMET (2020), FORCEDENTRY (2021) and BLASTPASS (2023) each turned a silently processed message attachment into code execution (Citizen Lab, Schneier).

2.2 The exploit chain, stage by stage

A modern iOS zero-click chain has roughly five stages, and each maps to a defense Apple later added. (a) Trigger parsing. The attacker sends a message whose attachment is auto-parsed by a privileged service — iMessage's BlastDoor sandbox, the Wallet/PassKit preview path, or ImageIO image decoding. The bug is typically memory corruption in a parser (JBIG2 in PDFs, libwebp WebP, font or GIF handling). (b) Sandbox escape. iOS 14 put iMessage parsing in BlastDoor precisely to contain this; FORCEDENTRY answered by building a fake CPU out of a compressed-image decoder to compute its way out (Bitdefender, TimeTrex). BLASTPASS answered BlastDoor differently — by routing a malicious PassKit attachment to the Wallet process so BlastDoor never saw it (GitHub reference). (c) Privilege escalation. A kernel bug promotes the escaped code to root/jailbreak privileges. (d) Implant and persistence. The loader fetches encrypted modules, sets persistence where possible, and aggressively deletes crash logs and message traces. (e) Command-and-control. The phone beacons to front domains, exfiltrates in small bursts, and accepts tasking (e.g. "record next call", "pull Signal database").

2.3 What it can do once resident

Assume full device access. Documented capabilities include reading SMS, mail, call logs, contacts, photos, videos, browsing history and stored passwords; scraping chat apps (WhatsApp, Signal, Telegram, iMessage, Viber, Facebook) after decryption on the endpoint, which is why end-to-end encryption does not stop it; precise GPS and location history; and live tasking of microphone and camera plus screenshots and keylogging (Council of Europe, Nextgov, Lookout). Android builds add RAT-style remote shell behavior (Avast). There is deliberately little user-visible symptom — no icon, no battery warning you can trust, and active cleanup of forensic traces.

3. How to detect if you are hacked

3.1 What symptoms can and cannot tell you

Short version: there are no reliable symptoms. Overheating, battery drain, data spikes and random reboots are cited in consumer press but occur for many benign reasons and are actively avoided by Pegasus, which throttles exfiltration and deletes logs. Absence of symptoms proves nothing, and "my phone feels slow" is not evidence either way. Treat any self-diagnosis app-store "Pegasus scanner" as snake oil — real detection is forensic, offline, and expert-reviewed. The two signals worth acting on are out-of-band: an Apple threat notification (Apple warns users it believes were individually targeted by mercenary spyware (TechCrunch)) and being in a high-risk group (journalist, activist, lawyer, opposition figure, or in contact with one) around the time of a known campaign.

3.2 The serious method: MVT forensic scan

Amnesty International's Security Lab publishes the methodology and the open-source Mobile Verification Toolkit (MVT), peer-reviewed by Citizen Lab (Amnesty methodology, Wikipedia). MVT compares a backup or filesystem dump plus logs against published indicators of compromise (IOCs): Pegasus C2 domains, iMessage lookup emails, and process/file artifacts (Amnesty GitHub IOCs via methodology page, MVT repo). iPhones yield more traces than Androids, so detection is easier on iOS (TechCrunch).

Practical walkthrough (do this on a clean computer, with the cooperation of the person at risk, and preserve the original device state):

# 1. Install MVT and fetch current IOCs
pipx install mvt
mvt-ios download-iocs        # or: mvt-android download-iocs

# 2a. iPhone: take an ENCRYPTED local backup (Finder/iTunes), then scan it
mvt-ios check-backup --output ./mvt-out ~/path/to/encrypted-backup \
  --iocs ~/path/to/iocs/*.stix2

# 2b. iPhone with jailbreak / Android with root: richer filesystem dump
mvt-ios check-fs --output ./mvt-out /path/to/fs-dump --iocs ~/path/to/iocs/*.stix2
mvt-android check-bugreport --output ./mvt-out bugreport.zip --iocs ~/path/to/iocs/*.stix2

# 3. Read ./mvt-out/*.json — look for matches flagged against Pegasus IOCs,
#    suspicious iMessage attachments, and process names Amnesty associates
#    with Pegasus. Anything flagged needs expert review, not deletion.

Caveats that matter: a negative MVT result is not a clean bill of health — IOCs age fast, newer infrastructure won't match old lists, and traces get wiped; a positive needs confirmation by Amnesty, Citizen Lab, or a qualified incident-response lab before you claim compromise publicly. Do not factory-reset before imaging if you intend forensic analysis — you destroy the evidence. If Apple sent a threat notification, or MVT flags Pegasus IOCs, contact Amnesty Security Lab or Citizen Lab and a trusted incident responder; journalists can also reach the Committee to Protect Journalists (CPJ).

4. Prevention: what actually helps

4.1 The short list, in order

Patch immediately, every time. Every major Pegasus chain ended with an emergency update (Sept 2021 for FORCEDENTRY, Sept 2023 for BLASTPASS). Delay is the vulnerability. Enable automatic OS and app updates on iOS and Android, and reboot daily — many chains are memory-resident and a reboot can disrupt a non-persistent stage (not a cure, but cheap).

Enable Lockdown Mode (iPhone). This is the single strongest public mitigation. Citizen Lab documented Lockdown Mode blocking a live NSO attack against Mexican human-rights defenders, with real-time warnings on the PWNYOURHOME attempt (TechCrunch), and both Amnesty's lab chief and Citizen Lab state they have seen no case of successful mercenary-spyware compromise with Lockdown Mode enabled at the time of attack (MacRumors, Quick Digest). Turn it on via Settings → Privacy & Security → Lockdown Mode if you are at risk; it hardens message attachments, link previews, FaceTime, and browser JIT, at the cost of some convenience.

Shrink the attack surface. Disable unnecessary message previews and auto-downloads, avoid sideloading profiles and MDMs you didn't choose, use a hardened browser and keep WhatsApp/iMessage updated, separate high-risk contacts onto a dedicated number/device, and treat Viber/SMS links from unknown numbers as hostile — the February 2025 Serbia cases arrived exactly that way (Amnesty).

4.2 What does not help

Antivirus apps and app-store "spyware removers" cannot see Pegasus — it lives outside their sandbox and wipes its traces. Switching to an "encrypted phone" or relying on Signal/WhatsApp encryption alone does not help either, because Pegasus reads the endpoint before encryption is applied (Council of Europe). Factory reset is reasonable after forensic imaging if compromise is suspected, followed by setting up as new (not from backup), rotating credentials from a clean device, and revoking sessions — but do not present it as proof of removal.

5. Context your readers will expect

Pegasus is no longer alone. The EU Parliament's PEGA inquiry treats it as one instance of a mercenary-spyware market that includes Intellexa's Predator (notably a one-click chain, abused in Greece and beyond) (EU study, EU resolution). Legally, the tide has partly turned: the US put NSO on the Commerce Entity List in 2021 and restricted federal use of commercial spyware by executive order in March 2023 (TechCrunch, White House); a US jury ordered NSO to pay WhatsApp $167.3M punitive + $444,719 compensatory in May 2025 for the 1,400-victim attack (later reduced on punitive damages alongside an injunction barring further WhatsApp targeting) (Bloomberg Law, Reuters); Apple sued NSO in 2021 but moved to dismiss in September 2024, citing disclosure risks as the vendor landscape widened (HackerNews, Dark Reading).

This is general technical information, not forensic or legal advice. If you or a source may be targeted, get expert help before running scans or resetting devices.