Pegasus
Also known as: Pegasus for iOS, Pegasus for Android, Chrysaor
Pegasus is commercial spyware that, according to public reporting by Citizen Lab and others, has been used to monitor journalists, activists and politicians. It can be installed through exploit chains that need little or no user interaction, then reads messages, tracks location and turns on the microphone. In 2021 Citizen Lab captured a zero-click iMessage exploit chain, FORCEDENTRY, which Apple then patched.
- Public attribution and associated actors
- Commercial spyware developed by NSO Group and, according to public reporting, sold to government clients. In 2021 the US Department of Commerce added NSO Group to its Entity List.
- First seen
- Around 2016
- Platforms
- iOS, Android
- MITRE ATT&CK software entries
- S0289 Pegasus for iOSS0316 Pegasus for Android
Status: NSO Group was added to the US Department of Commerce Entity List in November 2021 (reported).
How it spreads or gets in
- Exploit chains delivered by malicious links or with no user interaction at all (zero-click), according to public research.
Key behaviours
- Gained elevated privileges on the phone through further exploits.
- Collected messages, contacts, call logs and location.
- Recorded audio through the microphone.
ATT&CK techniques
- T1664Exploitation for Initial Access
- T1404Exploitation for Privilege Escalation
- T1430Location Tracking
- T1429Audio Capture
- T1636.004Protected User Data: SMS Messages
- T1636.003Protected User Data: Contact List
- T1409Stored Application Data
Selected from the family's MITRE ATT&CK software entry.
Detection ideas
- Use mobile threat defence and forensic tools that check for known spyware traces.
- Treat unexpected device restarts, battery drain and odd messages as triggers for review.
- Act on threat notifications from platform vendors.
Defences that work
- Install OS updates immediately; zero-click chains rely on unpatched flaws.
- Use Apple Lockdown Mode or equivalent hardening for high-risk users.
- Reboot phones regularly, which can remove some non-persistent implants.