Loading story…
A UK court ordered Saudi Arabia to pay about £3 million (reported by Reuters as $4.1 million) to London-based Saudi dissident and satirist Ghanem Almasarir after finding he was targeted with Pegasus spyware and assaulted in London. The ruling follows a years-long legal battle in which Almasarir alleged that Saudi Arabia orchestrated both the hacking of his iPhone and a physical attack against him, and it marks a rare case in which a foreign state was held financially liable in the UK for alleged cross-border digital surveillance tied to commercial spyware.
The case builds on earlier findings from researchers at Citizen Lab and Amnesty International, who linked suspicious phishing messages sent to Almasarir and other Saudi dissidents abroad to Pegasus, the spyware developed by Israel's NSO Group. Reporting in 2018 said the targeting formed part of a broader surveillance campaign against critics of the Saudi government, including activists with links to murdered journalist Jamal Khashoggi. In 2022, a British judge allowed Almasarir's lawsuit to proceed, rejecting Saudi Arabia's sovereign immunity defense and finding sufficient evidence for the claim to be heard under the UK's personal injury exception.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
A UK court ordered Saudi Arabia to pay damages to London-based dissident Ghanem Almasarir over Pegasus spying and an assault, with reports putting the award at about £3 million or $4.1 million. The ruling marked a significant accountability outcome in litigation tied to alleged Saudi use of NSO Group spyware.
A British judge ruled that Almasarir could sue Saudi Arabia over alleged Pegasus targeting and a physical assault in London. The court rejected Saudi Arabia's sovereign immunity defense at this stage, finding sufficient basis for the claim to continue.
Citizen Lab and Amnesty International linked phishing messages sent to Saudi dissidents abroad, including Ghanem Almasarir and Yahya Assiri, to Pegasus spyware delivery attempts. The activity was reported as part of a broader surveillance effort believed to benefit Saudi Arabia and occurred before Jamal Khashoggi's murder.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
theguardian.com
Open sourcearchive.ph
Open sourcetheguardian.com
Open sourceforbes.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A London High Court judge awarded Saudi satirist and activist **Ghanem Al-Masarir** more than **£3 million (~$4.1M)** in damages after finding a “compelling basis” that his iPhones were hacked using **NSO Group’s Pegasus** spyware, resulting in **data exfiltration**. The court concluded the intrusion was “directed or authorised” by the **Kingdom of Saudi Arabia (KSA)** or agents acting on its behalf, rejecting Saudi Arabia’s attempt to avoid the case via **state immunity** arguments and proceeding after the kingdom stopped participating in the litigation. The ruling cited digital forensic evidence, including analysis by **Citizen Lab** researcher **Bill Marczak**, who identified **malicious text messages** consistent with Pegasus delivery and attributed the infections to the KSA. Al-Masarir alleged the spyware enabled extensive surveillance capabilities—location tracking, access to stored data, and activation of microphones/cameras—and said the targeting coincided with a 2018 physical assault in London that caused injuries and contributed to severe personal and professional harm, including ending his YouTube activity criticizing the Saudi government.
Jun 29, 2026
A UK court ordered the Kingdom of **Saudi Arabia** to pay **£3 million** in damages to London-based Saudi dissident **Ghanem Al-Masarir** after finding his iPhones were infected with **NSO Group’s Pegasus** spyware as part of a 2018 targeting campaign attributed to a Saudi operator dubbed **KINGDOM**. The ruling credited expert evidence from **Citizen Lab** researcher **Bill Marczak**, and the damages award covered injury, costs, and lost earnings tied to the spyware targeting and related harms; the decision was framed by advocates as a rare avenue for accountability for victims of mercenary spyware and transnational repression. Separately, civil society groups warned that spyware vendors linked to human rights abuses are attempting to launder their reputations by engaging with diplomatic initiatives intended to curb misuse of commercial hacking tools. The criticism followed an **NSO Group** “transparency report” highlighting its claimed participation in the **Pall Mall Process**—a French- and UK-led effort to develop governance for *Commercial Cyber Intrusion Capabilities (CCICs)*—even as officials said NSO was not invited and participation does not equate to human-rights compliance; critics pointed to continued allegations of Pegasus abuse, including reported targeting of journalists and civil society in countries such as **Serbia**.
Jun 29, 2026
Amnesty International reported that an employee and a Saudi activist living abroad were targeted with malicious WhatsApp and SMS messages carrying Saudi-themed lures and links tied to infrastructure believed to deliver **NSO Group's Pegasus** spyware. Its investigation identified more than 600 suspicious domains associated with Pegasus's anonymizing transmission network, describing how the platform used social engineering, relay nodes, and exploitation servers to silently compromise mobile devices for full surveillance. NSO said its tools were intended only for government customers investigating crime and terrorism, while Amnesty said the targeting showed abusive use of highly invasive surveillance technology against civil society. Amnesty later documented similar Pegasus activity against Moroccan human rights defenders **Maati Monjib** and **Abdessadak El Bouchattaoui**, who were targeted from at least 2017 through malicious SMS links and suspected mobile network injection attacks. The organization said Monjib's iPhone showed signs consistent with compromise, including Safari redirections to suspicious domains, wiped crash logs, a suspicious process, and a forced reboot, and linked parts of the infrastructure to previously identified NSO systems and a domain associated by Citizen Lab with the Moroccan-linked actor **ATLAS**. The findings, reinforced by broader Citizen Lab reporting on Pegasus operations across dozens of countries, pointed to sustained surveillance of dissidents and rights advocates beyond traditional criminal or counterterrorism use.
Jun 29, 2026