Pegasus questions: evidence and responsible response

In July 2021 a set of reports known as the Pegasus Project was published. Forbidden Stories and Amnesty International, working with several newsrooms, showed that spyware made by NSO Group and known as Pegasus had been used against journalists, human-rights defenders and people close to them in several countries. The tool can get into a phone without the target tapping a link — a zero-click attack — and then reach messages, the microphone and the camera.

This page is not a method for building or using such a tool, and it does not replace legal advice or a laboratory examination. The aim is to understand what has become clear about this class of attack from 2021 to 2026, and to match your response to your actual risk rather than to general panic.

What we know from 2021 to now

The mercenary spyware market did not disappear after 2021. Companies and governments still buy and sell such tools, and the ways in keep changing. Names and vendors may change; what they share is that the attack is expensive and selective, and is often designed for a specific device and a specific person.

A home antivirus and Play Protect are not designed to find this class of attack. A “clean” report from a store scanner does not mean the phone is free of mercenary spyware. Most people are not targets. If your work or the threats you receive put you in the circle of people who would interest a state or an NSO-like customer, you need a different set of assumptions.

1. Ask yourself whether you have received a specific threat, whether people around you have also been targeted, and whether your work would be worth a high cost to a state actor or a customer of that market.
2. Do not treat a general feeling of worry after reading the news as the same thing as a concrete reason.
3. Take simultaneous signs in several accounts seriously — sudden sign-outs, messages you did not send, an unknown device in the session list — even if they have nothing to do with Pegasus. Read them alongside the guide to responding to malware and phishing and the account-recovery guide.

What a zero-click attack means for everyday habits

With much ordinary malware, the target has to tap a link or install a file. In some Pegasus operations, entry came through a weakness in a messaging or calling app itself, without an action from you. The practical meaning is not that no precaution is worth taking; it is that, against this class of attacker, “I did not tap a link” is not by itself a guarantee that the phone is clean.

1. Do not postpone operating-system and messaging-app updates. Many zero-click entry paths were later closed by patches. A patch is not an eternal guarantee, but it shrinks known attack surface.
2. Limit installs from outside the official store. That does not stop every zero-click attack, but it closes more ordinary paths.
3. Do not put your whole digital life — banking, main mail, passkeys, a work archive — on one phone. If that device is the target, separating accounts across devices limits the damage.

A proportionate response, not a device filled with random tools

A home scan that finds nothing does not mean the phone is clean. If you have a concrete reason to worry — a direct threat, several accounts acting strangely at once, or an analysis by a trusted lab — do not fill the device with random apps. Those same apps can destroy evidence or spread data themselves.

1. If you can, take the device off the network or use it less for everyday work so that, if something is present, it spreads less. That is not proof of infection.
2. Preserve evidence: do not factory-reset the phone without a reason if you want a specialist examination. A reset may wipe traces a lab needs.
3. Get specialized digital-forensics help if it is available to you: a lab or a team with mercenary-spyware experience, not the first channel in a messenger that says “we will clean your phone.”
4. Tools exist that look for known traces, but they need skill to interpret. Do not treat an output on your own as conclusive proof that the phone is infected or clean.
5. Review sensitive accounts from another device you trust more: sessions, recent sign-ins, a change to the second factor. If you can, do not change passwords from the suspicious device itself.

Steps that still help against most threats

Keeping the operating system updated, limiting installs from outside the store, a screen lock, unique passwords and two-factor authentication do not make a very advanced zero-click attack impossible, but they shrink more ordinary attack surface, and for most people those are the right priority. If you have no specific threat, fear of Pegasus should not replace that work.

1. On iPhone, if you may be facing a sophisticated threat, look at Lockdown Mode: Settings > Privacy & Security > Lockdown Mode. The mode turns some features off so the attack surface is smaller, and it makes everyday work harder. It is not a substitute for updates and does not declare an attack mathematically impossible. More Apple-device detail is in the guide to iPhone and iPad security.
2. On Android, a supported operating system, a strong lock and avoiding installs from outside the store remain the baseline. Do not add a new scanner from a group chat.
3. Limit lock-screen notification previews for sensitive messengers and do not leave the device unlocked in a gathering. Do not confuse Pegasus with an ordinary thief of the device; both can matter at the same time.

What this page does not give you

• A list of instructions for breaking into someone else’s phone.
• A claim that a home app can reliably find or remove Pegasus.
• Advice that every reader should organize their life around fear of mercenary spyware.

If your threat is ordinary malware, phishing or a stolen account, follow the malware and phishing guide. That path is more suitable for most incidents.

How to keep evidence and who to talk to

If you are thinking about a specialist examination, do not just carry on with the device where it is, and do not tell the story in a public gathering at the same time. Do not put technical details of that same device and the suspicious signs in any open public channel or fully open public group.

1. Write down the dates of threats, strange messages and unknown sign-ins separately from the suspicious phone itself.
2. Do not hand the phone to the first unknown repair shop, or to someone who says a magic app will clean it.
3. If you have an organization with someone responsible for digital security, tell them. If your work is journalism or human-rights defence, ask for help through that profession’s support path, not through an advertisement on a social network.
4. If detention or a legal case is involved, coordinate legal preparation with a lawyer; this page is not legal advice.

What to do after an examination

Whatever the laboratory result, harden the accounts from another device: unique passwords, a second factor, closing unknown sessions. If the device should be set aside, move needed data into a fresh environment only along the path the specialist recommends, not by blindly copying an entire infected backup.

1. Even if the result is “no known trace found,” do not treat that as an eternal certificate; tools only see known traces, and newer versions may look different.
2. If infection is confirmed, set the device aside or reset it as that team advises, and rebuild accounts or sign in from fresh sessions.
3. After the crisis, do not put your whole life back onto a single phone.

Weigh Lockdown Mode against everyday life

Lockdown Mode limits some features and complex web technologies so that points sophisticated attacks have abused are less available. Some sites and attachments may not work properly. The mode also exists on iPad and Mac.

1. Before you turn it on, see which everyday tasks depend on those features.
2. Consider it first on the device that holds the most sensitive messages, not necessarily on every device in the house.
3. Do not treat turning it on as a substitute for operating-system patches, and after you turn it on keep taking updates from that device’s official path. If it disrupts everyday life too much, you can turn it off and weigh that same decision again against the real risk of your everyday life and work.

Common mistakes

• Assuming “I did not tap a link, so the phone cannot be infected” against a sophisticated attacker.
• Assuming every reader of a Pegasus story is a likely target.
• Installing several unknown scanners after reading a report and destroying evidence.
• Resetting the device immediately when a specialist examination is planned.
• Changing every password from the suspicious phone itself.
• Ignoring updates because “if they want to they will get in without a click, so a patch is useless.”

What to do today

1. If you have no specific threat, focus on updates, a screen lock and accounts; do not let fear of Pegasus replace those basics.
2. If you have a concrete reason, get specialized help, keep evidence and do not fill the device with random tools.
3. On iPhone, look at Lockdown Mode in Settings > Privacy & Security and judge whether its limits match your actual risk.
4. Do not make every sensitive account depend on a single device.
5. If you see signs in accounts and do not have a strong reason to suspect mercenary spyware, follow the ordinary malware and phishing path first, and only then seek specialized help if the worry remains.