NSO Group sold governments a zero-click spyware that hacked encrypted phones

By the late 2010s, consumer messaging apps encrypted messages end to end, and police and intelligence agencies complained that criminals and terrorists could 'go dark'. NSO Group, an Israeli firm founded in 2010, built Pegasus: spyware engineered by ex-cyberspies with government-honed skills to take over iPhones and Android phones silently. Mexico became its first overseas client in 2011, less than a year after the company was founded.

Pegasus works by attacking the device rather than the wire. Attacks can arrive as a malicious link in an SMS or iMessage; recent 'zero-click' versions deliver the spyware by sending a message that produces no notification, so the target does not even need to touch the phone. The software then reads anything the user can read - messages, photos, recordings, passwords, call logs, location - and can switch on cameras and microphones for real-time surveillance. Strong passwords and encryption offer little help, and techniques publicized in a 2016 report were changed within hours.

NSO licensed Pegasus only to governments: about 60 intelligence, military and law enforcement agencies in 40 countries, with exports approved by Israel's Defense Ministry. The company said it vetted clients' human rights records and did not operate the software itself, a structure that kept distance between the vendor and whatever customers did with the tool. NSO framed the product as the answer to terrorism and organized crime hiding behind encryption.

In July 2021 the Pegasus Project - The Washington Post, Forbidden Stories and 16 media partners - reported on a list of more than 50,000 phone numbers. Forensic analysis by Amnesty International's Security Lab found attempted or successful hacks of 37 phones belonging to journalists, human rights activists, business executives and two women close to murdered Saudi journalist Jamal Khashoggi; reporters identified more than 1,000 people on the list across 50 countries. NSO called the findings baseless but acknowledged terminating two client contracts over abuse allegations in the previous year.

Attack the phone itself, not the wire: silent zero-click intrusion needs no click, password or decryption

Encryption protects the wire, not the device; by compromising the phone itself Pegasus bypassed the strongest consumer protections without needing a password, a click or a decryption key.

Zero-click delivery removed the human error requirement, so even cautious, technically sophisticated targets such as journalists and activists could be infected while doing nothing at all.

Productizing world-class exploit engineering and licensing it to dozens of governments let NSO amortize expensive R&D, turning state-level phone hacking into a purchasable service.

Clients operated the software themselves, so NSO could deny involvement, dispute the forensic evidence and keep selling while abuses accumulated.

When encryption closes the wiretap channel, capable adversaries move to the endpoint: protect the device itself, because securing data in transit is not enough.

The Pegasus Project became the defining record of commercial spyware abuse. NSO called the findings exaggerated and baseless but acknowledged terminating two client contracts in the previous year (five in total), saying vetting had cost it $100 million. Amnesty's forensic methodology was peer-reviewed by Citizen Lab and judged sound; several journalists in the consortium found that they or family members had been infected. Apple, whose iPhones were the main target, said it was constantly adding protections, and the cat-and-mouse between spyware makers and phone vendors continued.