Loading story…
Israeli media reports alleged that Israel Police used NSO Group’s Pegasus spyware for years to monitor dozens of people, including senior government officials, mayors, protest leaders, journalists, activists, and associates and relatives of former prime minister Benjamin Netanyahu. According to the reports, some of those targeted were not suspected of crimes, and the surveillance was allegedly carried out without proper judicial authorization because investigators believed approval would not be granted.
The allegations triggered a widening political and legal backlash in Israel. Police initially denied any improper use of spyware, then said additional findings had changed the picture in some respects while maintaining that their actions were lawful and court-approved. Senior officials, including President Isaac Herzog and Interior Minister Ayelet Shaked, called for a thorough external investigation, and a committee of inquiry was appointed to examine the claims. The disclosures also raised questions about whether any unlawful surveillance could affect cases tied to Netanyahu, although prosecutors reportedly said the alleged spyware use was not connected to evidence in his corruption trial.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
Following the expanded allegations, senior officials including Interior Minister Ayelet Shaked and President Isaac Herzog called for an in-depth external investigation. The disclosures also raised questions about possible implications for Netanyahu's corruption trial, though prosecutors reportedly did not believe tainted spyware evidence was used there.
A later Calcalist report said the alleged spyware targeting extended to ministry heads, mayors, protest leaders, and associates and family members of former prime minister Benjamin Netanyahu. The report intensified scrutiny by suggesting many targets were not criminal suspects.
After the allegations surfaced, Israel Police initially denied any improper use of spyware. It later said additional findings had changed the situation in certain respects and that it would cooperate with investigations while maintaining its actions were lawful and court-approved.
Former attorney general Avichai Mandelblit appointed a committee of inquiry to examine allegations surrounding police use of spyware. This step was already underway by the time later reporting expanded the list of alleged targets.
Calcalist reported that Israel Police had allegedly used NSO Group's Pegasus spyware for years against dozens of people in Israel, including public officials, activists, journalists, and people connected to Benjamin Netanyahu. The report said some surveillance was conducted without judicial approval because police believed authorization would not be granted.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
972mag.com
Open sourcetimesofisrael.com
Open sourcecalcalistech.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Spain’s Audiencia Nacional (High Court) again closed its criminal investigation into the use of **NSO Group’s Pegasus** spyware against the mobile phones of senior Spanish government officials, citing a sustained lack of cooperation from **Israeli authorities**. Judge **José Luis Calama** said Israel failed to respond to multiple formal requests for assistance (letters rogatory), preventing attribution of the operation to specific individuals and violating international cooperation obligations and the “principle of good faith” between states. The probe began after Spain disclosed that the phones of Prime Minister **Pedro Sánchez** and Defence Minister **Margarita Robles** had been infected (Pegasus is described as **zero-click** spyware marketed for use by state agencies). Reporting also indicates the Interior and Agriculture ministers were targeted, and that Sánchez’s device was infected multiple times. The case had previously been shelved and later reopened after **French authorities** shared information tied to similar Pegasus intrusions affecting French officials and civil society, but the Spanish court ultimately concluded it could not proceed without Israeli cooperation; the earlier revelations also contributed to the dismissal of Spain’s intelligence chief and public acknowledgment of shortcomings at the national intelligence center (**CNI**).
Jun 29, 2026
Forensic investigations and media reports found that **Pegasus** spyware, developed by Israel-based NSO Group and marketed to governments, was used in Mexico to target a wide range of individuals tied to politically sensitive issues. Confirmed targets included international investigators examining the disappearance of the 43 Ayotzinapa students, journalists, lawyers, human rights defenders, public health advocates backing Mexico’s soda tax, and senior opposition politicians from the PAN party. Citizen Lab linked multiple SMS lure campaigns to Pegasus infrastructure, including domains such as `smsmensaje[.]mx`, and documented social-engineering messages crafted around news reports, death notices, and other urgent themes. The disclosures intensified allegations that Mexican authorities used surveillance tools beyond criminal or counterterrorism purposes and instead against critics, civil society, and even internationally appointed officials. Mexican authorities denied responsibility and said they would investigate, but human rights groups, opposition lawmakers, U.N. experts, and European legislators called for an independent international inquiry and a halt to spyware use pending a full probe. The case widened into a major political and human rights scandal, with critics arguing that Mexico could not credibly investigate surveillance abuses allegedly tied to its own government.
Jun 29, 2026
Investigations by **Forbidden Stories**, **Amnesty International**, Citizen Lab and major news outlets found that NSO Group’s **Pegasus** spyware was repeatedly used far beyond stated counterterrorism and criminal investigations, with targets including journalists, human rights lawyers, anti-corruption activists, diplomats, aid workers, and political exiles. A leaked dataset of more than **50,000 phone numbers** linked to NSO customers and forensic analysis of examined devices showed confirmed or attempted infections on dozens of phones, including successful compromises of **Apple iPhones**. Reporting tied selections and infections to multiple governments and highlighted targeting of figures around the **Dalai Lama**, overseas numbers used by Americans, and civil society members across countries including Mexico, India, Hungary, Morocco and France. Mexico emerged as one of the clearest examples of abuse, where Pegasus-linked phishing messages and other surveillance tactics were used against prominent reporters, lawyers and activists investigating corruption, human rights abuses and politically sensitive cases. Separate reporting alleged that weak oversight and corruption allowed spyware bought by Mexican authorities to be misused and, in some cases, to reach actors connected to drug cartels, deepening risks for journalists and investigators. NSO denied that the leaked list represented Pegasus targets and said it sells only to vetted governments, but the disclosures prompted warnings about national security risks to U.S. personnel abroad and renewed calls, including from Edward Snowden, for a global crackdown on the commercial spyware trade.
Jul 3, 2026