Loading story…
Forensic investigations and media reports found that Pegasus spyware, developed by Israel-based NSO Group and marketed to governments, was used in Mexico to target a wide range of individuals tied to politically sensitive issues. Confirmed targets included international investigators examining the disappearance of the 43 Ayotzinapa students, journalists, lawyers, human rights defenders, public health advocates backing Mexico’s soda tax, and senior opposition politicians from the PAN party. Citizen Lab linked multiple SMS lure campaigns to Pegasus infrastructure, including domains such as smsmensaje[.]mx, and documented social-engineering messages crafted around news reports, death notices, and other urgent themes.
The disclosures intensified allegations that Mexican authorities used surveillance tools beyond criminal or counterterrorism purposes and instead against critics, civil society, and even internationally appointed officials. Mexican authorities denied responsibility and said they would investigate, but human rights groups, opposition lawmakers, U.N. experts, and European legislators called for an independent international inquiry and a halt to spyware use pending a full probe. The case widened into a major political and human rights scandal, with critics arguing that Mexico could not credibly investigate surveillance abuses allegedly tied to its own government.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
U.N. experts urged a halt to the use of spyware in Mexico and called for a full investigation into the surveillance allegations. Their intervention elevated the matter into an international human rights issue.
After the spyware allegations involving Ayotzinapa investigators were reported, Mexican authorities denied responsibility and said they would investigate. Critics argued that Mexico could not credibly investigate itself and called for an independent international inquiry.
The New York Times reported that international investigators examining the 2014 disappearance of 43 Ayotzinapa students were targeted with Pegasus spyware. Researchers said the Mexico campaign had at least 19 confirmed cases involving civil society members and international officials.
Citizen Lab reported that three senior Mexican opposition politicians from the PAN party were targeted in June and July 2016 with SMS-based Pegasus infection attempts. The report linked the messages to previously identified NSO infrastructure and showed the spyware campaign had expanded into electoral politics.
Citizen Lab disclosed that Mexican journalists, lawyers, a child, scientists, health advocates, and human rights defenders were targeted with NSO Group spyware. The findings tied the campaign to Pegasus exploit infrastructure and broadened public evidence of politically sensitive targeting in Mexico.
Citizen Lab reported that supporters of Mexico’s soda tax were targeted with NSO Group exploit links, extending evidence of Pegasus use against public-interest advocates in the country.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
7 references tracked. Mallory keeps watching after this page renders.
centroprodh.org.mx
Open sourcecitizenlab.ca
Open sourcecitizenlab.ca
Open sourcecitizenlab.ca
Open sourceusnews.com
Open sourcenytimes.com
Open sourcenytimes.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Investigations by **Forbidden Stories**, **Amnesty International**, Citizen Lab and major news outlets found that NSO Group’s **Pegasus** spyware was repeatedly used far beyond stated counterterrorism and criminal investigations, with targets including journalists, human rights lawyers, anti-corruption activists, diplomats, aid workers, and political exiles. A leaked dataset of more than **50,000 phone numbers** linked to NSO customers and forensic analysis of examined devices showed confirmed or attempted infections on dozens of phones, including successful compromises of **Apple iPhones**. Reporting tied selections and infections to multiple governments and highlighted targeting of figures around the **Dalai Lama**, overseas numbers used by Americans, and civil society members across countries including Mexico, India, Hungary, Morocco and France. Mexico emerged as one of the clearest examples of abuse, where Pegasus-linked phishing messages and other surveillance tactics were used against prominent reporters, lawyers and activists investigating corruption, human rights abuses and politically sensitive cases. Separate reporting alleged that weak oversight and corruption allowed spyware bought by Mexican authorities to be misused and, in some cases, to reach actors connected to drug cartels, deepening risks for journalists and investigators. NSO denied that the leaked list represented Pegasus targets and said it sells only to vetted governments, but the disclosures prompted warnings about national security risks to U.S. personnel abroad and renewed calls, including from Edward Snowden, for a global crackdown on the commercial spyware trade.
Jul 3, 2026
Amnesty International reported that an employee and a Saudi activist living abroad were targeted with malicious WhatsApp and SMS messages carrying Saudi-themed lures and links tied to infrastructure believed to deliver **NSO Group's Pegasus** spyware. Its investigation identified more than 600 suspicious domains associated with Pegasus's anonymizing transmission network, describing how the platform used social engineering, relay nodes, and exploitation servers to silently compromise mobile devices for full surveillance. NSO said its tools were intended only for government customers investigating crime and terrorism, while Amnesty said the targeting showed abusive use of highly invasive surveillance technology against civil society. Amnesty later documented similar Pegasus activity against Moroccan human rights defenders **Maati Monjib** and **Abdessadak El Bouchattaoui**, who were targeted from at least 2017 through malicious SMS links and suspected mobile network injection attacks. The organization said Monjib's iPhone showed signs consistent with compromise, including Safari redirections to suspicious domains, wiped crash logs, a suspicious process, and a forced reboot, and linked parts of the infrastructure to previously identified NSO systems and a domain associated by Citizen Lab with the Moroccan-linked actor **ATLAS**. The findings, reinforced by broader Citizen Lab reporting on Pegasus operations across dozens of countries, pointed to sustained surveillance of dissidents and rights advocates beyond traditional criminal or counterterrorism use.
Jun 29, 2026
Israeli media reports alleged that Israel Police used NSO Group’s **Pegasus** spyware for years to monitor dozens of people, including senior government officials, mayors, protest leaders, journalists, activists, and associates and relatives of former prime minister Benjamin Netanyahu. According to the reports, some of those targeted were not suspected of crimes, and the surveillance was allegedly carried out without proper judicial authorization because investigators believed approval would not be granted. The allegations triggered a widening political and legal backlash in Israel. Police initially denied any improper use of spyware, then said additional findings had changed the picture in some respects while maintaining that their actions were lawful and court-approved. Senior officials, including President Isaac Herzog and Interior Minister Ayelet Shaked, called for a thorough external investigation, and a committee of inquiry was appointed to examine the claims. The disclosures also raised questions about whether any unlawful surveillance could affect cases tied to Netanyahu, although prosecutors reportedly said the alleged spyware use was not connected to evidence in his corruption trial.
Jun 29, 2026