Pegasus Spyware Explained: How a Phone Can Be Hacked Without You Clicking Anything

Imagine placing your smartphone on the table, locking the screen, and walking away. You do not open a suspicious email. You do not download a strange app. You do not tap a sketchy text-message link. Yet somewhere in the background, an attacker may be attempting to exploit a flaw in software running on that phone and quietly turn one of your most personal possessions into a surveillance device.

That disturbing possibility is what made Pegasus spyware famous. Pegasus is a sophisticated surveillance platform developed by the Israeli company NSO Group and sold primarily for government intelligence and law-enforcement use. It has become one of the best-known examples of what security researchers increasingly call mercenary spyware: highly specialized commercial hacking technology sold to customers capable of paying for access to vulnerabilities, infrastructure, and surveillance capabilities far beyond the reach of an ordinary cybercriminal.

Pegasus is fascinating partly because it breaks many of the basic cybersecurity rules people have been taught for years. We are told not to click suspicious links, not to install unknown apps, and not to open strange attachments. Those habits remain extremely important, but some Pegasus attacks demonstrated something more unsettling: in certain cases, the victim apparently did not need to do anything at all. Security researchers have documented zero-click exploit chains capable of compromising phones through software such as iMessage without requiring the target to consciously interact with malicious content.

What Is Pegasus Spyware?

Pegasus is not a hacking technique, hacking group, or computer virus in the traditional sense. It is a commercial spyware system associated with NSO Group, an Israeli company that says its technologies are intended to help authorized government intelligence and law-enforcement agencies investigate terrorism and serious crime. NSO has repeatedly argued that its products have legitimate public-safety applications and that customers, rather than NSO itself, conduct investigations using the technology.

Once spyware such as Pegasus successfully compromises a smartphone, however, the potential value of that access is enormous. A modern phone may contain photographs, private messages, location information, contacts, email, authentication data, and years of personal history. Public investigations and litigation have described Pegasus capabilities that can potentially access information stored by applications and, in some circumstances, activate a phone’s microphone or camera.

The key point is that Pegasus attacks the endpoint. End-to-end encryption can make intercepted network traffic extremely difficult to read, but if an attacker compromises the phone where the decrypted message is actually displayed, the situation changes dramatically. Rather than defeating the mathematics behind an encrypted messaging system, advanced spyware can attempt to compromise the operating system or another trusted component and observe information after the legitimate device has already decrypted it.

To visualize what makes Pegasus different from ordinary malware, it helps to think of the attack as a chain rather than a single malicious app. The attacker needs a path into the device, enough control to overcome normal software restrictions, and finally a way to collect valuable information while avoiding detection.

The Part That Made Pegasus Famous: Zero-Click Attacks

Early reports about Pegasus included malicious links sent to targets. In that model, the attacker still needed the victim to do something wrong. A carefully designed message might impersonate a delivery notice, breaking-news story, or account warning, and clicking the link could send the device through an exploit chain. That is already dangerous, but it still leaves the victim with a defensive opportunity: do not click.

Zero-click exploitation removes that comfortable boundary. A vulnerable service may automatically process incoming data before the user ever sees or interacts with it. If the parsing code contains a sufficiently powerful vulnerability, a carefully constructed piece of incoming content may trigger unintended behavior simply by being received and processed. This is why complicated components such as messaging platforms, media decoders, image libraries, and browsers attract enormous attention from advanced exploit developers.

Citizen Lab’s discovery of FORCEDENTRY in 2021 became one of the clearest examples. Researchers examining the iPhone of a Saudi activist found evidence of a zero-day, zero-click exploit targeting Apple’s image-rendering system through iMessage. Apple subsequently patched the vulnerability. The important lesson was not merely that one bug existed; it was that a trusted application receiving ordinary-looking data could become the opening stage of a sophisticated remote compromise.

The story repeated itself in 2023. Citizen Lab documented another exploit chain called BLASTPASS, which researchers said could compromise an iPhone running iOS 16.6 without any interaction from the victim. The chain involved malicious PassKit attachments sent through iMessage, and Apple subsequently issued fixes. Citizen Lab also reported that Apple’s Lockdown Mode blocked that particular attack.

Zero-Day, Zero-Click and Exploit Chain: Three Terms Worth Understanding

These terms are often thrown together in news stories, but they describe different things. A zero-day vulnerability is a security flaw defenders do not yet have a patch for when attackers begin exploiting it. A zero-click attack requires no deliberate interaction from the victim. An exploit chain combines multiple vulnerabilities or techniques so that an attacker can move from an initial foothold toward deeper control of the device.

That final concept matters because modern smartphones are not supposed to let a single application take over everything. Android and iOS use sandboxing, permissions, code signing, hardware-backed security, and other layers designed to contain compromised software. An attacker therefore may need one vulnerability to execute code, another technique to escape a restricted process, and additional capabilities to reach the information ultimately being targeted.

Pegasus is particularly interesting to cybersecurity researchers because documented campaigns reveal an arms race between increasingly hardened mobile operating systems and attackers willing to spend extraordinary resources finding ways around those protections. A single vulnerability may not be enough anymore. Sophisticated attackers may combine several weaknesses into a complete path from receiving a message to gaining access to sensitive information.

Why Would Anyone Build Something This Powerful?

There is an uncomfortable but important argument on the other side of the Pegasus controversy. Governments face criminals, kidnappers, organized crime networks, and terrorist organizations that increasingly use encrypted communications and modern smartphones. Traditional wiretapping becomes less effective when conversations move onto strongly encrypted platforms. From a law-enforcement perspective, gaining lawful access to the device itself can therefore be extraordinarily valuable.

NSO Group’s position has long been that its products are designed for government intelligence and law-enforcement agencies fighting serious crime and terrorism. There is nothing inherently implausible about the argument that sophisticated digital surveillance could help authorities locate dangerous suspects, disrupt plots, or investigate organized crime. Even critics of Pegasus generally recognize that digital surveillance technology can have legitimate investigative uses under appropriate legal oversight.

The real controversy is therefore not simply whether surveillance technology can ever be useful. The harder question is whether a tool capable of silently compromising a person’s phone can reliably remain restricted to legitimate targets once governments possess it. That is where Pegasus stops being merely a technical cybersecurity story and becomes a political, legal, ethical, and human-rights issue.

The Evidence That Turned Pegasus Into a Global Scandal

In 2021, the Pegasus Project brought extraordinary attention to NSO Group after a journalism consortium coordinated by Forbidden Stories, with technical assistance from Amnesty International’s Security Lab, investigated a leaked dataset containing roughly 50,000 phone numbers described as potential surveillance targets. Journalists, activists, politicians, lawyers, and other prominent individuals appeared in the reporting.

One important distinction is often lost when the story is summarized. Appearing in that dataset was not by itself forensic proof that a particular phone had been successfully infected. A phone number might have been selected for consideration, investigated, unsuccessfully targeted, or associated with other intelligence activity. Treating every number on the list as a confirmed Pegasus infection would go beyond the evidence.

The strongest cases came from devices researchers were actually able to examine. Amnesty published a detailed forensic methodology describing traces its analysts associated with Pegasus infections, including suspicious processes, network activity, and artifacts stored inside device databases. Citizen Lab independently documented multiple Pegasus campaigns and captured exploit chains in the wild, sometimes providing information to technology companies that subsequently patched the underlying vulnerabilities.

That distinction between possible target, attempted target, and confirmed compromise is essential. Cybersecurity attribution is difficult, and sensational headlines can flatten different levels of evidence into one dramatic claim. Taking a skeptical approach does not make Pegasus less serious. In fact, focusing on the strongest forensic evidence makes the case considerably more credible.

How Researchers Catch Spyware Designed Not to Be Caught

Highly sophisticated spyware does not normally announce itself with a pop-up saying, “Your phone is infected.” The entire point is to remain invisible. That turns investigations into a form of digital archaeology: researchers examine logs, databases, crash reports, unusual process names, network connections, timestamps, and tiny inconsistencies left behind when software tries to hide its activity.

One interesting example emerged during the FORCEDENTRY investigation. Researchers identified forensic artifacts left behind by Pegasus even though the spyware attempted to remove evidence of its presence. In effect, efforts to clean up one part of the system reportedly left related traces elsewhere. Those fragments helped investigators connect what they were seeing to previously observed Pegasus activity.

This is an important cybersecurity lesson far beyond Pegasus. Sophisticated attackers may be stealthy, but computers are incredibly complicated systems with many interacting components. Files are cached, databases record activity, services crash, network requests occur, and timestamps accumulate. Perfectly erasing every artifact while continuously operating on an unfamiliar target device can be extremely difficult.

Could Pegasus Really Turn On Your Microphone or Camera?

Public forensic reporting and court disclosures have described Pegasus capabilities that go far beyond reading a single text message. Depending on the version, target device, operating system, and privileges obtained, spyware of this class may potentially access messages, call records, photographs, contacts, location information, email, application data, microphones, and cameras.

That is why a fully compromised smartphone is such an attractive intelligence target. Consider what a phone can reveal about its owner during an ordinary week:

• where the person travels and approximately when;
• who they communicate with;
• photographs and documents they carry;
• personal and professional email;
• calendars and contacts;
• authentication sessions for online services;
• conversations occurring near the device if microphone access is achieved.

The frightening part is not any single capability. It is the aggregation. Twenty years ago, acquiring this much intelligence about one person might have required several surveillance techniques operating simultaneously. Today, much of a person’s private and professional life is already concentrated inside one network-connected computer they voluntarily carry almost everywhere.

Does Pegasus Break Encryption?

Not necessarily in the way people imagine. Strong end-to-end encryption can still be doing exactly what it was designed to do while the endpoint itself has been compromised. If you send an encrypted message, the recipient’s phone eventually has to decrypt that message so a human can read it. Malware with sufficiently deep access to the phone may attempt to obtain information at or after that endpoint rather than mathematically cracking the encrypted transmission itself.

Think of it like having an extremely secure armored truck transporting a document. Breaking the armor may be almost impossible, but the document eventually has to be removed from the truck so somebody can read it. If an attacker is already hiding inside the recipient’s office, the strength of the armored truck no longer solves the entire security problem.

This distinction illustrates why cybersecurity cannot be reduced to one feature. A messaging application may have excellent encryption, but the operating system, media parser, browser, notification system, baseband, applications, and dozens of additional components still create an attack surface. Security is a stack, and advanced attackers search for the weakest usable point in that stack.

The Skeptical View: Is Pegasus Overhyped?

For the average person, there is one major reason not to panic: you are probably not worth a Pegasus-class attack. Companies such as Apple describe mercenary spyware operations as exceptionally expensive and technically complex attacks aimed at a very small number of specific individuals. The overwhelming majority of ordinary smartphone users are unlikely to encounter anything remotely this sophisticated.

This matters because cybersecurity coverage can accidentally convince people that every battery drain, warm phone, strange notification, or dropped call means a government is spying on them. Usually, there are much more mundane explanations. Consumer malware, stolen passwords, phishing, reused credentials, account takeovers, malicious browser extensions, and social engineering remain significantly more realistic threats for most people.

There is another reason for healthy skepticism: secrecy surrounds both spyware vendors and intelligence customers. Outside researchers frequently see fragments rather than entire operations, and governments rarely explain sensitive surveillance capabilities publicly. Claims should therefore be separated into what has been independently verified, what companies acknowledge, what victims allege, and what investigators infer from technical evidence.

But skepticism should work both ways. It would be equally unreasonable to dismiss the entire issue simply because every allegation cannot be independently proven. Citizen Lab, Amnesty International, technology companies, and independent investigators have produced technical artifacts, documented zero-click exploits, and helped vendors patch vulnerabilities. The existence of sophisticated mercenary spyware is not theoretical.

Pegasus Versus Ordinary Malware

Ordinary consumer malware is generally built around scale. Criminals might send hundreds of thousands of phishing messages because they only need a small percentage of recipients to fall for them. Commodity malware frequently relies on familiar weaknesses: people downloading the wrong program, entering passwords into fake websites, or running malicious attachments.

Pegasus represents almost the opposite economic model. The victim pool can be extremely small because each individual target may be enormously valuable. A journalist communicating with confidential sources, a government minister, an opposition politician, a senior military official, or someone connected to an organized criminal investigation might potentially justify a vastly more expensive attack.

This also explains why zero-day exploits do not remain useful forever. Once researchers discover a technique and vendors understand the underlying vulnerability, a patch can close that particular doorway. Attackers then need another vulnerability or another path into the device. Cybersecurity at this level is an expensive, continuous contest rather than a permanent magical backdoor.

What Happened With WhatsApp and NSO Group?

One of the most important chapters in the Pegasus story came from WhatsApp. The company said its engineers detected and disrupted a 2019 operation involving Pegasus that targeted more than a thousand WhatsApp users. WhatsApp subsequently sued NSO Group, creating an unusual situation in which a major technology company directly challenged a commercial spyware vendor through the courts.

The litigation has provided a rare public glimpse into an industry that normally operates behind secrecy. Meta has argued that Pegasus was capable of attacking both iOS and Android devices and that substantial resources were devoted to finding methods of exploiting messaging platforms, browsers, and operating systems. Because Meta is a party to the litigation, its claims should naturally be read in that context, but the case nevertheless revealed details that researchers normally struggle to obtain.

The lawsuit also raises a broader question for the cybersecurity industry. If private companies can commercially develop methods for secretly compromising software platforms, what responsibilities do platform owners, governments, courts, and spyware vendors have when those capabilities cross national borders? Pegasus is no longer simply a malware story. It is part of a much larger debate over who should be allowed to hack whom.

Can Pegasus Infect Android Phones Too?

Pegasus is often associated with iPhones because several of the most detailed public forensic reports involve iOS exploit chains. That does not mean Android devices are inherently immune. Public reporting and court proceedings have described Pegasus as capable of targeting both major mobile operating systems.

The visibility problem may also differ between platforms. Researchers can only document what they are able to obtain and reliably analyze, and forensic artifacts are not identical across Android and iOS. A lack of public detail about a particular Android technique should therefore never be interpreted as proof that the platform cannot be targeted.

The better way to think about mobile security is not “Which phone is impossible to hack?” No mainstream smartphone can honestly make that promise. The more useful question is which security architecture, update policy, threat-detection system, and user behavior make successful exploitation sufficiently difficult that most attackers decide the target is not worth the effort.

Would Antivirus Detect Pegasus?

Traditional antivirus is useful against many forms of malware, but Pegasus is a poor benchmark for judging everyday antivirus software. A carefully targeted exploit can use previously unknown vulnerabilities, rapidly changing infrastructure, and techniques deliberately designed to minimize obvious artifacts. Security vendors can develop detections after indicators become known, but advanced surveillance operators have a strong incentive to change those indicators quickly.

This is one reason modern device security increasingly relies on layers rather than a single antivirus application. Operating-system updates close vulnerabilities. Sandboxing restricts what compromised processes can reach. Hardware security features protect certain secrets. Threat-intelligence systems look for known targeting patterns, while specialized defensive modes deliberately remove unnecessary functionality from devices belonging to high-risk users.

For most people, the boring security advice is still the most useful: keep the operating system updated, use strong unique passwords, enable multi-factor authentication, and avoid installing questionable software. You do not need military-grade threat modeling to prevent the overwhelming majority of everyday cyberattacks.

Can Restarting Your Phone Get Rid of Pegasus?

You may occasionally see advice claiming that rebooting a phone defeats advanced spyware. That is too simplistic to treat as a reliable security strategy. Some historically observed mobile implants have had limited persistence, meaning a reboot could interrupt malware currently running in memory, but an attacker who retains a working exploit may be able to compromise the device again.

Modern spyware also evolves. Assuming a current version behaves exactly like a version analyzed several years ago is risky. Attackers learn from forensic investigations just as defenders learn from them, which means capabilities, persistence mechanisms, and exploitation techniques can change over time.

The safer conclusion is that rebooting should never replace patching, professional forensic assistance, or taking a legitimate security warning seriously. If someone genuinely belongs to a high-risk group and receives a credible mercenary-spyware warning, that situation deserves far more attention than simply turning the phone off and on again.

What Can You Actually Do to Protect Yourself?

Most readers do not need to live as though an intelligence agency is targeting them. They do, however, benefit from the same basic security practices that make ordinary attacks and sophisticated exploitation more difficult. Keeping phones updated remains particularly important because many advanced exploits lose their usefulness once the underlying vulnerability is patched.

For people at genuinely elevated risk, the security posture becomes more aggressive:

• Install operating-system and security updates promptly.
• Treat legitimate vendor threat notifications seriously.
• Consider Apple’s Lockdown Mode if targeted mercenary spyware is realistically part of your threat model.
• Protect sensitive accounts with strong, unique credentials and multi-factor authentication.
• Separate highly sensitive work from everyday personal activity when appropriate.
• Seek professional digital-forensics assistance if you have credible evidence of targeted surveillance.

Apple’s Lockdown Mode is particularly interesting because it deliberately sacrifices convenience for security. Certain message attachments, web technologies, invitations, device connections, and other capabilities can be restricted in order to reduce the number of pathways an attacker might exploit. For an ordinary person, those limitations may be unnecessary. For a journalist investigating a hostile government, however, the tradeoff may make much more sense.

Why Pegasus Still Matters Today

Pegasus matters even if you never become a Pegasus target. The larger story is the emergence of a private market for capabilities that were once associated almost exclusively with elite national intelligence organizations. Companies can research vulnerabilities, develop exploitation systems, build infrastructure, and sell surveillance capabilities to government customers.

The customer therefore does not necessarily need to build the entire offensive capability from scratch. Parts of the operation can effectively be purchased. This is why the term mercenary spyware is so appropriate: advanced digital surveillance has become something that governments and other powerful actors may obtain commercially.

Pegasus is also not the only example. Citizen Lab and other researchers have documented additional commercial spyware vendors and surveillance platforms, reinforcing the idea that Pegasus represents a wider industry rather than one unusual historical case. Even if Pegasus vanished tomorrow, the market incentives that created it would still exist.

That is arguably the most important takeaway. Pegasus itself is one product. Commercialized zero-day exploitation and targeted digital surveillance are the larger phenomenon.

The Bigger Cybersecurity Lesson

Pegasus exposes something uncomfortable about modern technology: security does not mean invulnerability. An iPhone or Android device can have excellent encryption, sandboxing, application review, hardware-backed security, and years of defensive engineering while still containing undiscovered bugs. Complex software inevitably creates attack surface.

But that does not mean security is pointless. FORCEDENTRY and BLASTPASS demonstrate the defensive side of the same story. Researchers found evidence, disclosed vulnerabilities, and Apple released patches. Lockdown Mode added another defensive layer. Each discovered exploit gives defenders additional information and may destroy a technique that previously cost attackers significant resources to develop.

There is also an interesting irony here. Pegasus became famous partly because it was designed to operate invisibly, yet repeated investigations demonstrate that stealth is not the same as invisibility. Phones keep records. Servers communicate. Software crashes. Databases preserve traces. Attackers make mistakes. Researchers compare evidence across victims and eventually reconstruct what happened.

That is cybersecurity in a nutshell. Attackers look for tiny weaknesses that defenders missed, while defenders search for tiny traces attackers failed to erase.

Final Verdict: Should You Be Worried About Pegasus?

For most people, Pegasus itself should not be near the top of your personal cybersecurity threat list. A reused password, convincing phishing page, stolen session cookie, compromised email account, malicious download, or social-engineering attack is dramatically more likely to cause trouble. If worrying about elite spyware causes somebody to ignore basic password hygiene and software updates, they have misunderstood the actual risk.

At the same time, Pegasus should concern anyone interested in where digital surveillance is heading. It demonstrated that commercial organizations can build and sell technology capable of remotely compromising some of the world’s most sophisticated consumer devices. It also showed how vulnerable a person’s private life can become once an attacker controls the smartphone that acts as a gateway to communications, identity, finances, location, and personal relationships.

The rational response is therefore neither panic nor dismissal. A skeptical reader should demand strong evidence for individual claims while recognizing the substantial forensic record showing that Pegasus and similar tools are real, technically advanced, and potentially extraordinarily intrusive. The deeper story is not simply that somebody built frightening spyware. It is that an international market now exists for turning undisclosed software vulnerabilities into surveillance capability.

And that market is unlikely to disappear just because one exploit gets patched.

Citizen Lab:
https://citizenlab.ca/research/forcedentry-nso-group-imessage-zero-click-exploit-captured-in-the-wild/

Apple — Protecting Against Mercenary Spyware:
https://support.apple.com/102174