Episode II / Pegasus / Case IV of 05
Published: 2026-08-16 · Last reviewed: 2026-08-17 · Evidence current through: 2026-08-17

Episode II — Pegasus, Case IV

They keep finding a way in. Apple keeps building a door. Neither stops.

Zero-click is a different kind of weapon

For years, spyware needed a click. A malicious link in an SMS, a poisoned attachment — the target had to do something. That left traces: a strange message in the inbox, a suspicious URL. Investigators could find them.CL20

Zero-click removed the click. The exploit fires while the phone is idle, inside the code that processes an incoming notification or image. No phishing message, no target action, often no visible sign at all. Google's Project Zero, which analyzed NSO's 2021 exploit in depth, put it plainly: "Short of not using a device, there is no way to prevent exploitation by a zero-click exploit; it's a weapon against which there is no defense."PZ

2019: the missed call that hacked the phone

The first widely documented NSO zero-click attack ran over WhatsApp, not iMessage. WhatsApp fixed a vulnerability in its calling feature in May 2019 — CVE-2019-3568 — a flaw that could be triggered by a missed voice call alone. NSO Group used it to target more than 1,400 WhatsApp users in a two-week period.CLFB

The attack was notable for more than its size. It proved that a commercial spyware vendor could silently compromise phones at scale through an encrypted messaging app — the same apps people use precisely because they believe them private.CL20

2020: KISMET — iMessage goes dark

In July and August 2020, government operatives hacked 36 personal phones belonging to journalists, producers, anchors, and executives at Al Jazeera, plus the phone of a journalist at London-based Al Araby TV. The exploit chain — named KISMET by Citizen Lab — was an invisible zero-click vulnerability in iMessage, a zero-day effective against at least iOS 13.5.1, including Apple's then-latest iPhone 11.CL20

Four Pegasus operators were identified in the attack. Citizen Lab attributed one, MONARCHY, to Saudi Arabia, and another, SNEAKY KESTREL, to the United Arab Emirates. The target list reads like a newsroom roster, not a criminal investigation.CL20

Apple builds BlastDoor

Apple's answer arrived in iOS 14: a hardened sandbox called BlastDoor, designed to isolate iMessage's data parsing so that a compromised parser could not reach the rest of the phone. Citizen Lab found no evidence that KISMET still worked against iOS 14.CL20

It was a genuine defensive advance. And it lasted about as long as the race required. Citizen Lab's own assessment: "We suspect that NSO Group developed FORCEDENTRY, which circumvents BlastDoor, in response to this mitigation."CL

2021: FORCEDENTRY — the GIF that wasn't a GIF

While analyzing the phone of a Saudi activist infected with Pegasus, Citizen Lab recovered a zero-day zero-click exploit against iMessage. They named it FORCEDENTRY. The files delivered to the phone carried the extension ".gif." They were not GIFs. Twenty-seven were Adobe PSD files; four were PDFs containing JBIG2-encoded streams.CL

The misdirection mattered. iMessage handed any ".gif" file to an image-processing component that guessed the real format by content, ignoring the extension. That single design shortcut suddenly exposed more than twenty image codecs — hundreds of thousands of lines of code — to remote, zero-click attack.PZ

Inside the "GIF" was a JBIG2-compressed PDF whose decoder had an integer overflow. Project Zero described what NSO did with it: over 70,000 segment commands were used to define logical bit operations — AND, OR, XOR, XNOR — and assemble a complete, tiny computer architecture with registers and a 64-bit adder, running entirely inside a single image-decompression pass. They called the exploit "one of the most technically sophisticated" they had ever seen, with capabilities "rivaling those previously thought to be accessible to only a handful of nation states."PZ

FORCEDENTRY was patched as CVE-2021-30860 on September 13, 2021 — the day Citizen Lab went public — in iOS 14.8, which also covered macOS and watchOS. It had been in use since at least February 2021. The processing that FORCEDENTRY abused ran outside the BlastDoor sandbox, which is why the sandbox did not stop it.CLPZ

2022: three new chains — the entry points multiply

In 2022, NSO Group's customers deployed at least three new zero-click chains against iOS 15 and iOS 16. Citizen Lab documented them after finding infections among members of Mexico's civil society, including two named human rights defenders at Centro PRODH, the legal-aid organization that represents victims of military abuses. Matching forensic indicators across a broader global pool of victims let Citizen Lab attribute the chains to NSO Group's Pegasus with high confidence, and publish the findings in April 2023 as "Triple Threat."CL22

The order of discovery ran backwards from the order of deployment. LATENTIMAGE — the earliest, identified last — hit a single device in January 2022; Citizen Lab named it for how few traces it leaves. FINDMYPWN was deployed from June 2022 as a zero-day against iOS 15.5 and 15.6. PWNYOURHOME followed from October 2022, deployed as a zero-day against iOS 16.0.3.CL22

FINDMYPWN and PWNYOURHOME changed the geometry of the race. Each was a two-step chain: FINDMYPWN began inside Find My — the fmfd process — and moved to iMessage; PWNYOURHOME began inside HomeKit — the homed daemon — and moved to iMessage, and it appeared to work even on phones whose owners had never configured a Home in HomeKit. Citizen Lab described them as the first zero-click exploits it had observed using two separate remote attack surfaces on the iPhone. The iMessage door was no longer the only entrance.CL22

The mitigations arrived in both directions of the race. After Citizen Lab shared forensic artifacts, Apple hardened HomeKit in iOS 16.3.1. iOS 16's Lockdown Mode — new in September 2022 — surfaced real-time warnings when PWNYOURHOME exploitation was attempted, and Citizen Lab saw no successful compromise of any device with Lockdown Mode enabled. NSO adapted as well: the 2022 Pegasus versions scrubbed their own log data from infected phones more thoroughly, in an apparent effort to erase the very traces researchers rely on. It slowed detection. It did not stop it.CL22

2023: BLASTPASS — the boarding pass that hacked the phone

In September 2023, while checking the device of an individual employed by a Washington DC-based civil-society organization, Citizen Lab found a new actively exploited zero-click chain. It was capable of compromising iPhones running the latest iOS 16.6 with no interaction from the victim. They named it BLASTPASS.CL23

The delivery vector was a PassKit attachment — the file format used for boarding passes and wallet tickets — sent over iMessage, containing a maliciously crafted image. The image was a WebP file exploiting a heap overflow in the WebP decoder bundled inside Apple's ImageIO — the same WebP flaw tracked separately as CVE-2023-4863.CL23PZ25

Project Zero's later analysis reconstructed the mechanics: a 5.5MB WebP file carrying a malformed Huffman tree that overwrote a nearby allocation, a heap groom of roughly half a million allocations churning through nearly a gigabyte of memory, and forged CoreFoundation objects to turn the corruption into code execution. The pattern echoed FORCEDENTRY — a compression-format bug, an oversized payload, a carefully groomed heap — rebuilt for the new defenses.PZ25

Apple shipped an emergency patch on the same day Citizen Lab published — iOS 16.6.1 — covering two CVEs: CVE-2023-41064 in ImageIO (the WebP flaw) and CVE-2023-41061 in Wallet. Apple's security team and Citizen Lab confirmed that Lockdown Mode blocked the attack.CL23

The race does not stop at the patch

Amnesty Security Lab later found BLASTPASS payloads delivered to the phone of Indian journalist Anand Mangnale of OCCRP in August 2023, after a series of HomeKit service crashes — an apparent fingerprinting phase before the exploit was sent over iMessage. The same Pegasus operator's account was then observed probing the phone of Siddharth Varadarajan, founding editor of The Wire.ASL

Project Zero's BLASTPASS writeup ended with a further note: crash logs received in late 2024 showed devices targeted in November 2023 — two months after the patch — via a separate parsing path that reached the WebP bug outside the BlastDoor sandbox. The exploit outlived its own disclosure window.PZ25

2026: NSO's own documents confirm the factory

In July 2026, Amnesty Security Lab published its most complete analysis of Pegasus to date — built in part on internal NSO Group material disclosed during the long-running WhatsApp v. NSO Group lawsuit. The documents confirm a catalogue of infection vectors developed over years: "Heaven," the first zero-click Android vector via WhatsApp; "Eden" and "Erised"; "Diablo" against iOS 11; "Dragonfly" against iOS 12 over iMessage; and the iOS 13 and iOS 14 chains later named KISMET and FORCEDENTRY.ASL26

NSO's own material frames the arms race as routine business. A dedicated "White Services" department registered anonymized accounts and infrastructure; a Network Operation Center monitored customer systems for failures and security alerts; and the set of supported infection vectors was, in the documents' own description, "constantly evolving as new vectors get developed by NSO Group and exploits get patched by device vendors."ASL26

"We assess this to be one of the most technically sophisticated exploits we've ever seen, further demonstrating that the capabilities NSO provides rival those previously thought to be accessible to only a handful of nation states." — Google Project Zero, December 2021, on FORCEDENTRYPZ

The pattern is structural, not incidental. Again and again, Apple closes one vector while NSO develops or deploys another. Each new sandbox has been treated as a design constraint for the next exploit. The phone in your pocket is not a platform for spyware to occasionally use — it is the battlefield the product is built around.CLASL26

This is what an arms race looks like when one side is a company selling access, and the other side is everyone else's phone.PZ