Loading story…
Spain’s Audiencia Nacional (High Court) again closed its criminal investigation into the use of NSO Group’s Pegasus spyware against the mobile phones of senior Spanish government officials, citing a sustained lack of cooperation from Israeli authorities. Judge José Luis Calama said Israel failed to respond to multiple formal requests for assistance (letters rogatory), preventing attribution of the operation to specific individuals and violating international cooperation obligations and the “principle of good faith” between states.
The probe began after Spain disclosed that the phones of Prime Minister Pedro Sánchez and Defence Minister Margarita Robles had been infected (Pegasus is described as zero-click spyware marketed for use by state agencies). Reporting also indicates the Interior and Agriculture ministers were targeted, and that Sánchez’s device was infected multiple times. The case had previously been shelved and later reopened after French authorities shared information tied to similar Pegasus intrusions affecting French officials and civil society, but the Spanish court ultimately concluded it could not proceed without Israeli cooperation; the earlier revelations also contributed to the dismissal of Spain’s intelligence chief and public acknowledgment of shortcomings at the national intelligence center (CNI).
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
9 events from the most recent confirmed update back to the earliest known activity.
Spain's judiciary publicly announced that the Audiencia Nacional had archived the Pegasus case for a second time because of Israel's obstruction of the investigation. The notice formalized the court's position that the probe could not continue without foreign cooperation.
On January 22, 2026, Judge José Luis Calama closed the investigation for a second time, saying Israel had ignored five cooperation requests, including efforts to obtain information from NSO Group and question its CEO. The court said the non-response blocked attribution and undermined international judicial cooperation obligations.
In February 2025, Spanish authorities issued another formal legal assistance request to Israel as part of the Pegasus investigation. Israel again did not respond, according to the court.
In April 2024, Spain's Audiencia Nacional reopened the Pegasus case after receiving information from France about similar spyware targeting. The reopening revived efforts to identify who was behind the infections of Spanish officials' phones.
French authorities provided Spain with information from their own Pegasus investigations involving journalists, lawyers, and government and parliamentary members. That material prompted renewed activity in the Spanish case, though it did not identify the actor behind the Spanish targeting.
In July 2023, Judge José Luis Calama closed the investigation for the first time because the perpetrator could not be identified. The court said the lack of cooperation and absence of attribution prevented further progress.
In May 2022, Spain publicly disclosed the Pegasus infections affecting Prime Minister Pedro Sánchez and Defence Minister Margarita Robles and opened a judicial investigation. The probe examined possible disclosure of secrets and crimes jeopardizing Spanish state security.
The mobile phones of Prime Minister Pedro Sánchez and Defence Minister Margarita Robles, and later additional ministers, were infected with Pegasus in 2021. The suspected intrusions were described as zero-click attacks affecting senior Spanish government officials.
Citizen Lab later found that at least 63 people linked to the Catalan pro-independence movement were targeted or infected with Pegasus during 2017-2020. Spanish authorities later said 18 of those cases had been lawfully conducted by Spain's intelligence service with judicial approval.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
theguardian.com
Open sourcetherecord.media
Open sourceenglish.elpais.com
Open sourcepoderjudicial.es
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Israeli media reports alleged that Israel Police used NSO Group’s **Pegasus** spyware for years to monitor dozens of people, including senior government officials, mayors, protest leaders, journalists, activists, and associates and relatives of former prime minister Benjamin Netanyahu. According to the reports, some of those targeted were not suspected of crimes, and the surveillance was allegedly carried out without proper judicial authorization because investigators believed approval would not be granted. The allegations triggered a widening political and legal backlash in Israel. Police initially denied any improper use of spyware, then said additional findings had changed the picture in some respects while maintaining that their actions were lawful and court-approved. Senior officials, including President Isaac Herzog and Interior Minister Ayelet Shaked, called for a thorough external investigation, and a committee of inquiry was appointed to examine the claims. The disclosures also raised questions about whether any unlawful surveillance could affect cases tied to Netanyahu, although prosecutors reportedly said the alleged spyware use was not connected to evidence in his corruption trial.
Jun 29, 2026
Forensic investigations and media reports found that **Pegasus** spyware, developed by Israel-based NSO Group and marketed to governments, was used in Mexico to target a wide range of individuals tied to politically sensitive issues. Confirmed targets included international investigators examining the disappearance of the 43 Ayotzinapa students, journalists, lawyers, human rights defenders, public health advocates backing Mexico’s soda tax, and senior opposition politicians from the PAN party. Citizen Lab linked multiple SMS lure campaigns to Pegasus infrastructure, including domains such as `smsmensaje[.]mx`, and documented social-engineering messages crafted around news reports, death notices, and other urgent themes. The disclosures intensified allegations that Mexican authorities used surveillance tools beyond criminal or counterterrorism purposes and instead against critics, civil society, and even internationally appointed officials. Mexican authorities denied responsibility and said they would investigate, but human rights groups, opposition lawmakers, U.N. experts, and European legislators called for an independent international inquiry and a halt to spyware use pending a full probe. The case widened into a major political and human rights scandal, with critics arguing that Mexico could not credibly investigate surveillance abuses allegedly tied to its own government.
Jun 29, 2026
Investigations by **Forbidden Stories**, **Amnesty International**, Citizen Lab and major news outlets found that NSO Group’s **Pegasus** spyware was repeatedly used far beyond stated counterterrorism and criminal investigations, with targets including journalists, human rights lawyers, anti-corruption activists, diplomats, aid workers, and political exiles. A leaked dataset of more than **50,000 phone numbers** linked to NSO customers and forensic analysis of examined devices showed confirmed or attempted infections on dozens of phones, including successful compromises of **Apple iPhones**. Reporting tied selections and infections to multiple governments and highlighted targeting of figures around the **Dalai Lama**, overseas numbers used by Americans, and civil society members across countries including Mexico, India, Hungary, Morocco and France. Mexico emerged as one of the clearest examples of abuse, where Pegasus-linked phishing messages and other surveillance tactics were used against prominent reporters, lawyers and activists investigating corruption, human rights abuses and politically sensitive cases. Separate reporting alleged that weak oversight and corruption allowed spyware bought by Mexican authorities to be misused and, in some cases, to reach actors connected to drug cartels, deepening risks for journalists and investigators. NSO denied that the leaked list represented Pegasus targets and said it sells only to vetted governments, but the disclosures prompted warnings about national security risks to U.S. personnel abroad and renewed calls, including from Edward Snowden, for a global crackdown on the commercial spyware trade.
Jul 3, 2026