Loading story…
A London High Court judge awarded Saudi satirist and activist Ghanem Al-Masarir more than £3 million (~$4.1M) in damages after finding a “compelling basis” that his iPhones were hacked using NSO Group’s Pegasus spyware, resulting in data exfiltration. The court concluded the intrusion was “directed or authorised” by the Kingdom of Saudi Arabia (KSA) or agents acting on its behalf, rejecting Saudi Arabia’s attempt to avoid the case via state immunity arguments and proceeding after the kingdom stopped participating in the litigation.
The ruling cited digital forensic evidence, including analysis by Citizen Lab researcher Bill Marczak, who identified malicious text messages consistent with Pegasus delivery and attributed the infections to the KSA. Al-Masarir alleged the spyware enabled extensive surveillance capabilities—location tracking, access to stored data, and activation of microphones/cameras—and said the targeting coincided with a 2018 physical assault in London that caused injuries and contributed to severe personal and professional harm, including ending his YouTube activity criticizing the Saudi government.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
On January 26, 2026, Judge Pushpinder Saini awarded Ghanem Al-Masarir more than £3 million in damages after finding compelling evidence that Pegasus spyware infected his devices. The ruling held that the hacking was directed or authorized by Saudi Arabia and recognized severe privacy and personal harms, including psychiatric injury and loss of income.
After 2023, Saudi Arabia no longer filed a defense or otherwise engaged with the court proceedings. This non-participation contributed to the court entering summary judgment.
In 2022, the High Court rejected Saudi Arabia's attempt to claim state immunity in the case. After this failed defense, the Kingdom later stopped participating in the proceedings.
Ghanem Al-Masarir sued the Saudi government in 2019 over the alleged Pegasus targeting of his phone. The case sought accountability for the spyware intrusion and related harms.
In 2018, Ghanem Al-Masarir's iPhones were hacked using NSO Group's Pegasus spyware, with forensic evidence indicating data exfiltration and surveillance capabilities. The High Court later found a compelling basis that the operation was directed or authorized by Saudi Arabia or its agents.
The court later found Saudi Arabia was probably responsible for a physical assault on Saudi dissident Ghanem Al-Masarir in London as part of efforts to silence his criticism. The assault was described as occurring around the same period as the spyware targeting in 2018.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
grahamcluley.com
Open sourcescworld.com
Open sourcetechcrunch.com
Open sourcetherecord.media
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A UK court ordered Saudi Arabia to pay about **£3 million** (reported by Reuters as **$4.1 million**) to London-based Saudi dissident and satirist **Ghanem Almasarir** after finding he was targeted with **Pegasus** spyware and assaulted in London. The ruling follows a years-long legal battle in which Almasarir alleged that Saudi Arabia orchestrated both the hacking of his iPhone and a physical attack against him, and it marks a rare case in which a foreign state was held financially liable in the UK for alleged cross-border digital surveillance tied to commercial spyware. The case builds on earlier findings from researchers at **Citizen Lab** and **Amnesty International**, who linked suspicious phishing messages sent to Almasarir and other Saudi dissidents abroad to Pegasus, the spyware developed by Israel's **NSO Group**. Reporting in 2018 said the targeting formed part of a broader surveillance campaign against critics of the Saudi government, including activists with links to murdered journalist **Jamal Khashoggi**. In 2022, a British judge allowed Almasarir's lawsuit to proceed, rejecting Saudi Arabia's sovereign immunity defense and finding sufficient evidence for the claim to be heard under the UK's personal injury exception.
Jun 29, 2026
A UK court ordered the Kingdom of **Saudi Arabia** to pay **£3 million** in damages to London-based Saudi dissident **Ghanem Al-Masarir** after finding his iPhones were infected with **NSO Group’s Pegasus** spyware as part of a 2018 targeting campaign attributed to a Saudi operator dubbed **KINGDOM**. The ruling credited expert evidence from **Citizen Lab** researcher **Bill Marczak**, and the damages award covered injury, costs, and lost earnings tied to the spyware targeting and related harms; the decision was framed by advocates as a rare avenue for accountability for victims of mercenary spyware and transnational repression. Separately, civil society groups warned that spyware vendors linked to human rights abuses are attempting to launder their reputations by engaging with diplomatic initiatives intended to curb misuse of commercial hacking tools. The criticism followed an **NSO Group** “transparency report” highlighting its claimed participation in the **Pall Mall Process**—a French- and UK-led effort to develop governance for *Commercial Cyber Intrusion Capabilities (CCICs)*—even as officials said NSO was not invited and participation does not equate to human-rights compliance; critics pointed to continued allegations of Pegasus abuse, including reported targeting of journalists and civil society in countries such as **Serbia**.
Jun 29, 2026
Amnesty International reported that an employee and a Saudi activist living abroad were targeted with malicious WhatsApp and SMS messages carrying Saudi-themed lures and links tied to infrastructure believed to deliver **NSO Group's Pegasus** spyware. Its investigation identified more than 600 suspicious domains associated with Pegasus's anonymizing transmission network, describing how the platform used social engineering, relay nodes, and exploitation servers to silently compromise mobile devices for full surveillance. NSO said its tools were intended only for government customers investigating crime and terrorism, while Amnesty said the targeting showed abusive use of highly invasive surveillance technology against civil society. Amnesty later documented similar Pegasus activity against Moroccan human rights defenders **Maati Monjib** and **Abdessadak El Bouchattaoui**, who were targeted from at least 2017 through malicious SMS links and suspected mobile network injection attacks. The organization said Monjib's iPhone showed signs consistent with compromise, including Safari redirections to suspicious domains, wiped crash logs, a suspicious process, and a forced reboot, and linked parts of the infrastructure to previously identified NSO systems and a domain associated by Citizen Lab with the Moroccan-linked actor **ATLAS**. The findings, reinforced by broader Citizen Lab reporting on Pegasus operations across dozens of countries, pointed to sustained surveillance of dissidents and rights advocates beyond traditional criminal or counterterrorism use.
Jun 29, 2026