Loading story…
A UK court ordered the Kingdom of Saudi Arabia to pay £3 million in damages to London-based Saudi dissident Ghanem Al-Masarir after finding his iPhones were infected with NSO Group’s Pegasus spyware as part of a 2018 targeting campaign attributed to a Saudi operator dubbed KINGDOM. The ruling credited expert evidence from Citizen Lab researcher Bill Marczak, and the damages award covered injury, costs, and lost earnings tied to the spyware targeting and related harms; the decision was framed by advocates as a rare avenue for accountability for victims of mercenary spyware and transnational repression.
Separately, civil society groups warned that spyware vendors linked to human rights abuses are attempting to launder their reputations by engaging with diplomatic initiatives intended to curb misuse of commercial hacking tools. The criticism followed an NSO Group “transparency report” highlighting its claimed participation in the Pall Mall Process—a French- and UK-led effort to develop governance for Commercial Cyber Intrusion Capabilities (CCICs)—even as officials said NSO was not invited and participation does not equate to human-rights compliance; critics pointed to continued allegations of Pegasus abuse, including reported targeting of journalists and civil society in countries such as Serbia.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
7 events from the most recent confirmed update back to the earliest known activity.
Civil society organizations publicly warned that spyware vendors linked to human rights abuses were trying to use diplomatic initiatives like the Pall Mall Process to rehabilitate their image without meaningful reform.
After NSO publicized its submission, French and U.K. officials said the company had not been invited and that submitting comments did not amount to participation, compliance, or recognition as a responsible actor.
On January 7, 2026, NSO Group released a transparency report highlighting that it had submitted input to the Pall Mall Process, prompting criticism from civil society groups.
In January 2026, a UK court awarded £3 million to London-based Saudi dissident Ghanem Al-Masarir after finding he had been targeted with NSO Group's Pegasus spyware and crediting expert evidence from Citizen Lab.
Amnesty International reported that Pegasus spyware was used to target Serbian journalists, adding to the record of abuse tied to NSO Group's technology.
France and the U.K. launched the Pall Mall Process in February 2024 to develop governance for Commercial Cyber Intrusion Capabilities such as spyware.
In 2018, Citizen Lab found that a Saudi Pegasus operator it called 'KINGDOM' targeted dissidents abroad, including sending Ghanem Al-Masarir malicious links that led to infection of his iPhone.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
citizenlab.ca
Open sourcetherecord.media
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A London High Court judge awarded Saudi satirist and activist **Ghanem Al-Masarir** more than **£3 million (~$4.1M)** in damages after finding a “compelling basis” that his iPhones were hacked using **NSO Group’s Pegasus** spyware, resulting in **data exfiltration**. The court concluded the intrusion was “directed or authorised” by the **Kingdom of Saudi Arabia (KSA)** or agents acting on its behalf, rejecting Saudi Arabia’s attempt to avoid the case via **state immunity** arguments and proceeding after the kingdom stopped participating in the litigation. The ruling cited digital forensic evidence, including analysis by **Citizen Lab** researcher **Bill Marczak**, who identified **malicious text messages** consistent with Pegasus delivery and attributed the infections to the KSA. Al-Masarir alleged the spyware enabled extensive surveillance capabilities—location tracking, access to stored data, and activation of microphones/cameras—and said the targeting coincided with a 2018 physical assault in London that caused injuries and contributed to severe personal and professional harm, including ending his YouTube activity criticizing the Saudi government.
Jun 29, 2026
A UK court ordered Saudi Arabia to pay about **£3 million** (reported by Reuters as **$4.1 million**) to London-based Saudi dissident and satirist **Ghanem Almasarir** after finding he was targeted with **Pegasus** spyware and assaulted in London. The ruling follows a years-long legal battle in which Almasarir alleged that Saudi Arabia orchestrated both the hacking of his iPhone and a physical attack against him, and it marks a rare case in which a foreign state was held financially liable in the UK for alleged cross-border digital surveillance tied to commercial spyware. The case builds on earlier findings from researchers at **Citizen Lab** and **Amnesty International**, who linked suspicious phishing messages sent to Almasarir and other Saudi dissidents abroad to Pegasus, the spyware developed by Israel's **NSO Group**. Reporting in 2018 said the targeting formed part of a broader surveillance campaign against critics of the Saudi government, including activists with links to murdered journalist **Jamal Khashoggi**. In 2022, a British judge allowed Almasarir's lawsuit to proceed, rejecting Saudi Arabia's sovereign immunity defense and finding sufficient evidence for the claim to be heard under the UK's personal injury exception.
Jun 29, 2026
Amnesty International reported that an employee and a Saudi activist living abroad were targeted with malicious WhatsApp and SMS messages carrying Saudi-themed lures and links tied to infrastructure believed to deliver **NSO Group's Pegasus** spyware. Its investigation identified more than 600 suspicious domains associated with Pegasus's anonymizing transmission network, describing how the platform used social engineering, relay nodes, and exploitation servers to silently compromise mobile devices for full surveillance. NSO said its tools were intended only for government customers investigating crime and terrorism, while Amnesty said the targeting showed abusive use of highly invasive surveillance technology against civil society. Amnesty later documented similar Pegasus activity against Moroccan human rights defenders **Maati Monjib** and **Abdessadak El Bouchattaoui**, who were targeted from at least 2017 through malicious SMS links and suspected mobile network injection attacks. The organization said Monjib's iPhone showed signs consistent with compromise, including Safari redirections to suspicious domains, wiped crash logs, a suspicious process, and a forced reboot, and linked parts of the infrastructure to previously identified NSO systems and a domain associated by Citizen Lab with the Moroccan-linked actor **ATLAS**. The findings, reinforced by broader Citizen Lab reporting on Pegasus operations across dozens of countries, pointed to sustained surveillance of dissidents and rights advocates beyond traditional criminal or counterterrorism use.
Jun 29, 2026