Press to release document — or hit Enter
Episode II — Pegasus, Case I
5W+1H — Case Summary
WHO: Jamal Khashoggi — Saudi journalist, Washington Post columnist, US permanent resident, and prominent critic of Crown Prince Mohammed bin Salman. Also targeted or selected: wife Hanan Elatr, fiancée Hatice Cengiz, son Abdullah Khashoggi, and other close contacts.
WHAT: Pegasus spyware was used against people around Khashoggi before and after his October 2018 murder. Forensic reporting confirmed infection of Cengiz's phone after the killing and targeting of other associates.
WHEN: Elatr's phone showed Pegasus activity in April 2018. Khashoggi was killed on October 2, 2018. Cengiz's phone was infected on October 6, 9, and 12, 2018. The Pegasus Project published its findings in July 2021.
WHERE: Istanbul, Turkey; Saudi and Emirati-linked surveillance operations; phones and contacts tied to Khashoggi's personal and political network.
WHY: Khashoggi was a high-profile dissident whose writing and pro-democracy organizing threatened Saudi political leadership. Surveillance around him mapped his network before and after the killing.
HOW: NSO Group's Pegasus gave government clients covert access to phones through exploit chains and phishing infrastructure. The leaked Pegasus Project data and forensic analysis connected spyware activity to Khashoggi's circle.
Pegasus is military-grade spyware developed by NSO Group, an Israeli cyber-intelligence firm founded in 2010 by veterans of Unit 8200 — Israel's equivalent of the NSA. Once installed on a phone, Pegasus grants the operator complete access: messages (including WhatsApp, Signal, and Telegram), photos, passwords, GPS location, the microphone, the camera, and every keystroke. All without the user knowing.
It is deployed via zero-click exploits — no link to tap, no attachment to open. A missed iMessage or WhatsApp call is enough to compromise the device. The user takes no action. The infection is invisible.
NSO Group sells Pegasus exclusively to government agencies. A single license costs millions. But the company has repeatedly sold to regimes with documented records of targeting journalists, activists, and political opponents — Saudi Arabia, UAE, India, Hungary, Morocco, Mexico, Azerbaijan, and others.FSCLPZ
Jamal Khashoggi was a Saudi journalist, a columnist for The Washington Post, and a US permanent resident. He was one of the most prominent critics of Crown Prince Mohammed bin Salman. On October 2, 2018, at 13:14 local time, he entered the Saudi consulate in Istanbul to obtain divorce paperwork. His fiancée Hatice Cengiz waited outside. He never emerged.
But Khashoggi had been under surveillance long before he walked through that door. Pegasus had already been deployed against his inner circle months earlier.
His wife Hanan Elatr's phone was targeted in the months leading up to the killing. After October 2, the targeting expanded: four days after the murder, Cengiz's phone was infected with Pegasus. Weeks later, Khashoggi's son Abdullah was added to the target list.
Reporting also identified spoofed media and delivery-link infrastructure used in Pegasus campaigns against Saudi dissidents. In Khashoggi's case, the targets were not only the dissident himself but the people closest to him.
"We assess that Saudi Arabia's Crown Prince Muhammad bin Salman approved an operation in Istanbul, Turkey to capture or kill Saudi journalist Jamal Khashoggi." — US Office of the Director of National Intelligence, February 26, 2021ODNI
Khashoggi was not an isolated target. In July 2021, The Pegasus Project — an investigation coordinated by Forbidden Stories and Amnesty International involving 80+ journalists from 17 media organizations — obtained a leaked database of 50,000+ phone numbers selected as persons of interest by NSO clients across more than 50 countries.
At least 180 journalists across 20 countries appeared on the list. Morocco alone had 10,000+ numbers selected. Mexico: 15,000. Later investigations confirmed infections of high-level officials, including Spanish Prime Minister Pedro Sánchez and Defence Minister Margarita Robles.
Amnesty International's Security Lab examined 67 phones and confirmed 23 successful Pegasus infections with 14 additional signs of attempted penetration; the remaining 30 tests were inconclusive, often because handsets had been replaced.AICL
Apple and NSO Group have been in a continuous arms race since at least 2018. Each time Apple patches a vulnerability, NSO finds a new one:
2019: WhatsApp calling exploit (CVE-2019-3568) — 1,400 phones targeted in two weeks.
2020: KISMET exploit against iOS 13.5.1 via iMessage.
2021: FORCEDENTRY — the most sophisticated. Sent via a malicious .gif that wasn't actually a .gif. It exploited the JBIG2 image codec to bypass Apple's Pointer Authentication Codes and disable ASLR. Apple responded with BlastDoor — a sandbox for iMessage data.
2023: BLASTPASS — NSO bypassed BlastDoor using PassKit attachments with embedded WebP images. The exploit chained through libwebp (CVE-2023-4863).
Eight documented iOS exploit chains in four years. The phone in your pocket is a battlefield.CLCL22PZ25ASL
In November 2021, the US Commerce Department placed NSO Group on the Entity List — banning American companies from selling technology to the firm. The stated reason: "Developed and supplied spyware to foreign governments that used these tools to maliciously target government officials, journalists, businesspeople, activists, academics, and embassy workers."BIS
Yet NSO continued to operate. In court filings, the company admitted that Pegasus represented "100 percent of NSO's sales in 2025." One product. One purpose.
In October 2025, NSO Group was acquired by US investors led by Hollywood producer Robert Simonds. The restructuring shed approximately $600 million in debt. All three co-founders — Niv Karmi, Shalev Hulio, and Omri Lavie — lost their shares.TC
In November 2025, David Friedman was appointed Chairman. Friedman is the former US Ambassador to Israel under the Trump administration. NSO court filings now state that "it is reasonably foreseeable that a law enforcement or intelligence agency of the United States will use Pegasus."TOI
In June 2026 — just weeks ago — Meta filed a contempt motion, accusing NSO of violating a permanent injunction by launching new spear-phishing attempts and test accounts on WhatsApp. The spyware kept flying.ArsMeta
Client roster
Countries confirmed to have deployed Pegasus against journalists, activists, and political opponents. Not exhaustive.
Sources: The Pegasus Project (2021), Citizen Lab, Amnesty International, HRW. Not exhaustive.
"A journalist was located, isolated, and killed. A commercial spyware product mapped the people around him — before and after his death. The manufacturer was sanctioned. Then sold. Refinanced. Rebranded with US capital and a former ambassador. As of June 2026, the injunction meant to stop it is contested."
This is not a story about one tool or one country. This is the infrastructure of surveillance.