Episode II / Pegasus / Case 01 of 05
Last reviewed: 2026-08-17 · Evidence current through: 2026-08-17

Episode II — Pegasus, Case I

A journalist walked into a consulate. The phones around him had already been targeted.

What is Pegasus?

Pegasus is military-grade spyware developed by NSO Group, an Israeli cyber-intelligence firm founded in 2010 by veterans of Unit 8200 — Israel's equivalent of the NSA. Once installed on a phone, Pegasus grants the operator complete access: messages (including WhatsApp, Signal, and Telegram), photos, passwords, GPS location, the microphone, the camera, and every keystroke — with no visible indication to the target.

It is deployed via zero-click exploits — no link to tap, no attachment to open. A missed iMessage or WhatsApp call is enough to compromise the device. The user takes no action, and typically sees nothing. "Invisible" describes the target's experience, not the forensic record: analysis of a device can still reveal traces of infection — that is precisely how the infections in this case were documented.

NSO Group sells Pegasus exclusively to government agencies. A single license costs millions. But the company has repeatedly sold to regimes with documented records of targeting journalists, activists, and political opponents — Saudi Arabia, UAE, India, Hungary, Morocco, Mexico, Azerbaijan, and others.FSCLPZ

The Khashoggi case

Jamal Khashoggi was a Saudi journalist, a columnist for The Washington Post, and a US permanent resident. He was one of the most prominent critics of Crown Prince Mohammed bin Salman. On October 2, 2018, at 13:14 local time, he entered the Saudi consulate in Istanbul to obtain divorce paperwork. His fiancée Hatice Cengiz waited outside. He never emerged.

But Khashoggi had been under surveillance long before he walked through that door. Pegasus had already been deployed against his inner circle months earlier.

His wife Hanan Elatr's phone showed Pegasus activity dating to April 2018, according to forensic analysis published by the Pegasus Project. After October 2, the targeting expanded: four days after the murder, Cengiz's phone was infected with Pegasus — on October 6, 9, and 12, 2018. Weeks later, Khashoggi's son Abdullah was added to the target list.

Reporting also identified spoofed media and delivery-link infrastructure used in Pegasus campaigns against Saudi dissidents. In Khashoggi's case, the targets were not only the dissident himself but the people closest to him. What published forensics have not established is that Khashoggi's own device was ever compromised — the evidence runs through the phones around him.

"We assess that Saudi Arabia's Crown Prince Muhammad bin Salman approved an operation in Istanbul, Turkey to capture or kill Saudi journalist Jamal Khashoggi." — US Office of the Director of National Intelligence, February 26, 2021ODNI

Reporting: WaPoFSCL

The global scale

Khashoggi was not an isolated target. In July 2021, The Pegasus Project — an investigation coordinated by Forbidden Stories and Amnesty International involving 80+ journalists from 17 media organizations — obtained a leaked database of 50,000+ phone numbers selected as persons of interest by NSO clients across more than 50 countries.

At least 180 journalists across 20 countries appeared on the list. Morocco alone had 10,000+ numbers selected. Mexico: 15,000. Later investigations confirmed infections of high-level officials, including Spanish Prime Minister Pedro Sánchez and Defence Minister Margarita Robles.

Amnesty International's Security Lab examined 67 phones and confirmed 23 successful Pegasus infections with 14 additional signs of attempted penetration; the remaining 30 tests were inconclusive, often because handsets had been replaced.AICL

The arms race

Apple and NSO Group have been in a continuous arms race since at least 2018. Each time Apple patches a vulnerability, NSO finds a new one:

2019: WhatsApp calling exploit (CVE-2019-3568) — 1,400 phones targeted in two weeks.

2020: KISMET exploit against iOS 13.5.1 via iMessage.

2021: FORCEDENTRY — the most sophisticated. Sent via a malicious .gif that wasn't actually a .gif. It exploited the JBIG2 image codec to bypass Apple's Pointer Authentication Codes and disable ASLR. Apple responded with BlastDoor — a sandbox for iMessage data.

2023: BLASTPASS — NSO bypassed BlastDoor using PassKit attachments with embedded WebP images. The exploit chained through libwebp (CVE-2023-4863).

Multiple documented exploit chains in four years — KISMET (2020), FORCEDENTRY (2021), BLASTPASS (2023) — each answered by a patch, each followed by the next chain. The phone in your pocket is a battlefield.CLCL22PZ25ASL

The company that kept selling

In November 2021, the US Commerce Department placed NSO Group on the Entity List — banning American companies from selling technology to the firm. The stated reason: "Developed and supplied spyware to foreign governments that used these tools to maliciously target government officials, journalists, businesspeople, activists, academics, and embassy workers."BIS

Yet NSO continued to operate. In court filings, the company admitted that Pegasus represented "100 percent of NSO's sales in 2025." One product. One purpose.CT

In October 2025, NSO Group was acquired by US investors led by Hollywood producer Robert Simonds. The restructuring shed approximately $600 million in debt. All three co-founders — Niv Karmi, Shalev Hulio, and Omri Lavie — lost their shares.TC

In November 2025, David Friedman was appointed Chairman. Friedman is the former US Ambassador to Israel under the Trump administration. NSO court filings now state that "it is reasonably foreseeable that a law enforcement or intelligence agency of the United States will use Pegasus."TOI

In June 2026, Meta filed a contempt motion, accusing NSO of violating a permanent injunction by launching new spear-phishing attempts and test accounts on WhatsApp. The spyware kept flying.ArsMeta