Most cyberattacks need the user to make a mistake. Someone has to click a link, open a document, install an app, or hand over a password.
But what happens when a phone can be infected without any of that?
That is what makes Pegasus one of the most sophisticated pieces of spyware ever built. In some cases, receiving a message is enough. The user does not need to open it, click a link, or install anything.
Pegasus is spyware developed by the Israeli company NSO Group and sold to government agencies for security purposes. Documents and investigations have repeatedly shown, however, that the technology has also been used against journalists, activists, lawyers, and other individuals.
What is Pegasus?
Pegasus is a program that primarily targets iPhone and Android devices.
Unlike a classic virus that spreads from one computer to the next, Pegasus is designed to covertly infect a specific device and give the attacker access to its data.
In July 2026, Amnesty International published a detailed analysis of how Pegasus has evolved, drawing in part on internal NSO Group material made public during the WhatsApp v. NSO Group lawsuit. The material gives a much clearer picture of how the system works and how it has developed over the years.
One of its defining characteristics is zero-click.
What does zero-click mean?
"Zero-click" means the victim does not need to click anything.
In a classic phishing attack, for example, the user receives an email and has to click a link for the attack to work.
In a zero-click attack, simply receiving or processing a piece of data on the phone can be enough to trigger the attack.
This makes such an attack far harder for the user to notice.
How is the device infected?
The process varies with the Pegasus version and the attack method. Published material on Pegasus shows that the system relies on several infection methods, including zero-click attacks, attacks where the victim has to take an action, and methods that use network infrastructure.
A typical attack happens in stages:
1. Identifying the phone
The attacker first has to identify the target.
NSO's internal material shows that Pegasus collects information such as:
- the phone number;
- whether the device is an iPhone or Android;
- whether the phone is switched on and connected to a network;
- which network it is using;
- whether the device is roaming.
This helps the attacker determine whether the phone can be attacked and which method to use.
2. Exploiting a vulnerability
Next, a vulnerability in the operating system or in one of the phone's apps is exploited.
One of the best-known examples is FORCEDENTRY, an exploit discovered in 2021 that abused the way iPhones processed certain files sent via iMessage.
The attack used a manipulated file that looked like a GIF image. In reality, the file contained PDF data and exploited a flaw in JBIG2 image processing. Citizen Lab attributed the attack to Pegasus, and Apple fixed the vulnerability in iOS 14.8.
Google Project Zero described FORCEDENTRY as one of the most complex exploits it had ever analyzed. It used a highly unusual technique to perform computations through the JBIG2 data-processing mechanism.
3. Bypassing the phone's security
Modern phones have many security mechanisms.
Apps run in isolated environments on the device and have limited access to the rest of the system. On the iPhone, for example, mechanisms such as the sandbox and other protections restrict what an app can do.
In the FORCEDENTRY case, the exploit chain used the initial vulnerability to get past the system's protections and gain higher privileges.
4. Taking control and collecting data
Once installation succeeds, Pegasus can give the attacker access to a wide range of information.
According to the material analyzed by Amnesty International, the documented capabilities include:
- messages and communications;
- contacts;
- call history;
- GPS location data;
- browser history;
- microphone access;
- camera access;
- data stored on the device;
- credentials and data linked to cloud services;
- scheduled microphone recordings.
In some cases, the system can schedule recordings based on the device's calendar, making the surveillance even harder to notice.
Can antivirus detect it?
This is one of the main problems.
Pegasus is designed specifically to be as hard to detect as possible. Citizen Lab's analyses have documented mechanisms for hiding activity and, in some cases, for erasing traces.
That does not mean Pegasus never leaves traces. On the contrary, specialized forensic analysis of the device can uncover signs of infection.
The problem is that an ordinary user cannot rely only on what they see on the phone.
A battery that drains faster, a phone that runs hot, or unusual data usage are not evidence of a Pegasus infection.
Who has been targeted with Pegasus?
Pegasus was built and sold as a tool for state authorities. But investigations have documented its use against people who are not simply the subjects of criminal investigations.
The Pegasus Project, an international investigation published in 2021, identified tens of thousands of phone numbers that had been selected as potential surveillance targets.
Among them were journalists, activists, politicians, lawyers, and others.
An important distinction: the fact that a phone number was selected as a target does not automatically mean the phone was infected.
Journalists and activists
There are documented cases in several countries where Pegasus was used, or its use was attempted, against journalists and activists.
In Serbia, for example, Amnesty International and BIRN documented attempts in 2025 to target two BIRN journalists with Viber messages linked to Pegasus. In at least one case the link was never opened, and the investigation showed that Pegasus had not been successfully installed.
This example matters because it shows another side of the story: not every attempt to deploy Pegasus ends with an infected phone.
The Jamal Khashoggi case
The name of Saudi journalist Jamal Khashoggi has also been linked to the Pegasus investigations.
Investigations have documented the use of Pegasus against people connected to Khashoggi and his inner circle.
Pegasus and encryption
A common question is:
If WhatsApp, Signal, or iMessage are encrypted, how can the messages be read?
The answer is simple: encryption protects the message while it is in transit, but it cannot protect a device that has already been compromised.
If spyware controls the phone, it can read the information on the device itself, before it is encrypted or after it has been decrypted.
So even an app with end-to-end encryption cannot guarantee the security of data on a compromised phone. We covered the same principle, from a different angle, in our analysis of EncroChat, Sky ECC, and WhatsApp.
That is why device security matters just as much as communication security.
What have Apple and the authorities done?
Pegasus has triggered legal and political responses as well.
In 2021, the United States added NSO Group to its Entity List, stating that the company had developed and supplied spyware that foreign governments used to target journalists, activists, government officials, and others.
In 2023, the US also issued an executive order restricting the use of commercial spyware by federal agencies where it poses a significant risk to national security or where there is a risk of improper use by foreign governments.
In a separate case, WhatsApp v. NSO Group, a US jury found NSO liable in May 2025 and awarded damages. In October 2025, the court also issued a permanent injunction barring NSO from targeting WhatsApp with Pegasus.
How can we protect ourselves from Pegasus?
There is no way to guarantee that a phone will never be targeted by sophisticated spyware. But some measures can significantly reduce the risk.
Keep your phone updated
This is the single most important measure.
Many attacks rely on vulnerabilities that are unknown or not yet patched on the device. Once the manufacturer releases a security update, installing it as quickly as possible is essential.
Use Lockdown Mode on iPhone when the risk is high
Apple offers Lockdown Mode, a protection mode created specifically for people who may be targeted by highly sophisticated attacks, including Pegasus.
When enabled, it restricts certain features that can be used as part of an attack, including some types of files received via iMessage and advanced browser technologies.
It is not an option every user necessarily needs. It is designed for cases of particular risk.
Don't rely on restarting the phone alone
Restarting the phone has historically been mentioned as a measure that can interrupt some spyware variants.
But it should not be treated as a reliable fix.
Recent findings show that some modern variants use mechanisms that allow the attacker to reinfect the device after a restart. A restart is therefore not a way to confirm that the phone is clean.
Enable two-factor authentication
2FA does not stop Pegasus directly, but it is an important baseline security measure for your accounts.
Also use unique passwords and keep your apps and operating system up to date.
If you suspect an attack, treat the phone as compromised
If you are a high-risk individual and have concrete reasons to suspect your phone has been targeted, do not rely on the device's behavior alone.
A specialized forensic investigation may be needed to determine whether there are signs of compromise.
Apple also sends Threat Notifications to users who, according to its analysis, have been targeted by highly sophisticated spyware attacks. Apple describes these notifications as high-confidence alerts.
Conclusion
Pegasus shows that a phone's security does not depend only on a password, the apps we use, or the fact that we avoid suspicious links.
In a zero-click attack, the victim may do nothing wrong at all.
This does not mean every phone is at immediate risk from Pegasus. In fact, Apple stresses that the vast majority of users will never be targeted by this kind of attack. But Pegasus makes clear that highly advanced attacks exist that can bypass even standard protections.
For businesses and individuals who handle sensitive information, the message is simple:
Communication security starts with the security of the device we communicate from.
Sources
- Amnesty International Security Lab - Inside Pegasus: The evolution of the world's most notorious spyware system, 2026.
- Citizen Lab - FORCEDENTRY: NSO Group iPhone, iPad, Mac Zero-Click Exploit, 2021.
- Google Project Zero - technical analysis of FORCEDENTRY, 2021.
- Apple - Lockdown Mode and protections against sophisticated attacks.
- Apple - Threat Notifications.
- U.S. Bureau of Industry and Security - NSO Group added to the Entity List, 2021.
- U.S. Executive Order on Commercial Spyware, 2023.
- WhatsApp v. NSO Group - court ruling, 2025.
- BIRN / Amnesty International - attempted use of Pegasus against journalists in Serbia, 2025.
