Loading story…
Amnesty International reported that an employee and a Saudi activist living abroad were targeted with malicious WhatsApp and SMS messages carrying Saudi-themed lures and links tied to infrastructure believed to deliver NSO Group's Pegasus spyware. Its investigation identified more than 600 suspicious domains associated with Pegasus's anonymizing transmission network, describing how the platform used social engineering, relay nodes, and exploitation servers to silently compromise mobile devices for full surveillance. NSO said its tools were intended only for government customers investigating crime and terrorism, while Amnesty said the targeting showed abusive use of highly invasive surveillance technology against civil society.
Amnesty later documented similar Pegasus activity against Moroccan human rights defenders Maati Monjib and Abdessadak El Bouchattaoui, who were targeted from at least 2017 through malicious SMS links and suspected mobile network injection attacks. The organization said Monjib's iPhone showed signs consistent with compromise, including Safari redirections to suspicious domains, wiped crash logs, a suspicious process, and a forced reboot, and linked parts of the infrastructure to previously identified NSO systems and a domain associated by Citizen Lab with the Moroccan-linked actor ATLAS. The findings, reinforced by broader Citizen Lab reporting on Pegasus operations across dozens of countries, pointed to sustained surveillance of dissidents and rights advocates beyond traditional criminal or counterterrorism use.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
8 events from the most recent confirmed update back to the earliest known activity.
Citizen Lab published research on how Saudi-linked digital espionage reached Canadian soil, adding further public reporting on Pegasus-related surveillance activity.
Citizen Lab published research tracing NSO Group Pegasus spyware operations to 45 countries, expanding public attribution of the spyware's global deployment.
In 2019, Amnesty identified suspected mobile network injection attacks against Maati Monjib's iPhone, including Safari redirections to suspicious domains, wiped crash logs, a suspicious process, and a forced reboot, leading it to believe at least one compromise succeeded.
Amnesty International reported that Moroccan human rights defenders Maati Monjib and Abdessadak El Bouchattaoui were targeted from at least 2017 with malicious SMS messages containing exploit links tied to NSO Group Pegasus infrastructure.
On 2019-10-10, Amnesty International published findings that two Moroccan human rights defenders had been targeted with NSO Group Pegasus spyware and linked parts of the infrastructure to previously identified NSO systems and a domain associated by Citizen Lab with the Moroccan-linked actor ATLAS.
In October 2018, Amnesty International later released the full list of suspicious domains identified in its NSO Group investigation to the research community.
In June 2018, an Amnesty International staff member and a Saudi activist living abroad received malicious WhatsApp and SMS messages with Saudi-themed bait and links associated with NSO Group Pegasus delivery infrastructure.
On 2018-08-01, Amnesty International published research linking the June 2018 targeting and more than 600 suspicious domains to NSO Group's Pegasus Anonymizing Transmission Network, and included NSO Group's response denying misuse of its tools.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
5 references tracked. Mallory keeps watching after this page renders.
citizenlab.ca
Open sourcecitizenlab.ca
Open sourceamnesty.org
Open sourcesecurityaffairs.com
Open sourceamnesty.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Investigations by **Forbidden Stories**, **Amnesty International**, Citizen Lab and major news outlets found that NSO Group’s **Pegasus** spyware was repeatedly used far beyond stated counterterrorism and criminal investigations, with targets including journalists, human rights lawyers, anti-corruption activists, diplomats, aid workers, and political exiles. A leaked dataset of more than **50,000 phone numbers** linked to NSO customers and forensic analysis of examined devices showed confirmed or attempted infections on dozens of phones, including successful compromises of **Apple iPhones**. Reporting tied selections and infections to multiple governments and highlighted targeting of figures around the **Dalai Lama**, overseas numbers used by Americans, and civil society members across countries including Mexico, India, Hungary, Morocco and France. Mexico emerged as one of the clearest examples of abuse, where Pegasus-linked phishing messages and other surveillance tactics were used against prominent reporters, lawyers and activists investigating corruption, human rights abuses and politically sensitive cases. Separate reporting alleged that weak oversight and corruption allowed spyware bought by Mexican authorities to be misused and, in some cases, to reach actors connected to drug cartels, deepening risks for journalists and investigators. NSO denied that the leaked list represented Pegasus targets and said it sells only to vetted governments, but the disclosures prompted warnings about national security risks to U.S. personnel abroad and renewed calls, including from Edward Snowden, for a global crackdown on the commercial spyware trade.
Jul 3, 2026
A UK court ordered the Kingdom of **Saudi Arabia** to pay **£3 million** in damages to London-based Saudi dissident **Ghanem Al-Masarir** after finding his iPhones were infected with **NSO Group’s Pegasus** spyware as part of a 2018 targeting campaign attributed to a Saudi operator dubbed **KINGDOM**. The ruling credited expert evidence from **Citizen Lab** researcher **Bill Marczak**, and the damages award covered injury, costs, and lost earnings tied to the spyware targeting and related harms; the decision was framed by advocates as a rare avenue for accountability for victims of mercenary spyware and transnational repression. Separately, civil society groups warned that spyware vendors linked to human rights abuses are attempting to launder their reputations by engaging with diplomatic initiatives intended to curb misuse of commercial hacking tools. The criticism followed an **NSO Group** “transparency report” highlighting its claimed participation in the **Pall Mall Process**—a French- and UK-led effort to develop governance for *Commercial Cyber Intrusion Capabilities (CCICs)*—even as officials said NSO was not invited and participation does not equate to human-rights compliance; critics pointed to continued allegations of Pegasus abuse, including reported targeting of journalists and civil society in countries such as **Serbia**.
Jun 29, 2026
Meta’s WhatsApp said it will ask a U.S. court to hold **NSO Group** in contempt after alleging the spyware vendor again used WhatsApp infrastructure to target users with **Pegasus** spyware, despite a prior court order barring such activity. Citizen Lab said the new allegations point to continued targeted surveillance through messaging platforms, with researchers arguing the reported conduct strengthens the case for ongoing sanctions and further legal consequences against NSO. The allegations fit a broader pattern in which Pegasus and similar mobile spyware have been delivered through **zero-click** chains in apps such as WhatsApp and iMessage, often leaving only limited forensic traces. Prior reporting and technical analysis have tied Pegasus to exploits including `CVE-2019-3568`, while later research highlighted newer WhatsApp- and Apple-related exploit chains, artifacts such as **CASCADEFAIL**, and the need for high-risk organizations to rely on mobile telemetry, network monitoring, forensic review, and protections such as Apple **Lockdown Mode** to detect or blunt sophisticated mobile intrusions.
Jun 29, 2026