Pegasus Spyware: Who It Targets and How to Check Your iPhone

Most spyware needs you to make a mistake. Click the wrong link, open the wrong attachment, grant the wrong permission. Some versions of Pegasus don't need any of that.

Developed by Israeli surveillance company NSO Group, Pegasus is spyware that, in some documented attacks, has taken control of an iPhone without the owner doing a single thing. No tap, no click, no interaction at all. That's what makes it unlike almost any other threat ordinary people have heard of, and why it's worth understanding even if you're not a head of state or a war correspondent.

Here's what Pegasus actually is, who it goes after, and what you can do to check whether your device has been touched by it.

What is Pegasus spyware?

Pegasus is a surveillance tool built to be invisible. Once it's on your phone, it can read your messages, listen through your microphone, activate your camera, track your location in real time, and pull passwords, call logs, and photos, all without leaving any obvious sign that it's there.

NSO Group markets it as a lawful-intercept product sold exclusively to government agencies for fighting terrorism and serious crime. But investigations have shown it's been used to spy on journalists, lawyers, activists, and opposition politicians across dozens of countries.

What makes Pegasus technically extraordinary is how it gets in. Early versions sent malicious links via SMS, baiting targets into tapping them. From at least 2017, according to Amnesty's Security Lab, NSO Group has had what researchers call zero-click exploits: infection methods that require zero interaction from the target. A specially crafted iMessage arrives, iOS processes it in the background, and the device is compromised before the notification even appears. The message can then delete itself. Citizen Lab researchers documented a zero-click iMessage exploit, known as FORCEDENTRY, that was used as a zero-day against iPhones, including an iPhone 12 Pro Max running iOS 14.6, the latest version at the time, and circumvented Apple's BlastDoor security framework.

Once installed, Pegasus gains root-level access. It can read messages on the device itself, after they've been decrypted, which means end-to-end encryption in apps like Signal and WhatsApp offers no protection once the phone is compromised. It can record calls, exfiltrate files, and operate silently in the background even when the screen is off.

Who does Pegasus target?

Pegasus isn't random malware. It's expensive, tightly licensed, and deployed with specific people in mind.

The Pegasus Project, a 2021 investigation by more than 80 journalists across 17 media organizations, analyzed a leaked database of over 50,000 phone numbers that NSO Group's government clients selected as potential targets. NSO disputes that the list shows Pegasus targets, and a number on it doesn't prove a phone was infected. At least 180 journalists were identified in the data, alongside hundreds of politicians, government officials, human rights activists, and sitting heads of state. OCCRP, one of the 17 investigative partners, confirmed the database contained numbers from across the globe.

Amnesty identified 11 likely NSO client countries, including Mexico, India, Saudi Arabia, the UAE, Hungary, Azerbaijan, and Morocco. High-profile cases include:

• Jamal Khashoggi's circle. Citizen Lab found Pegasus on the phone of Saudi dissident Omar Abdulaziz, a Khashoggi associate, in 2018. The Pegasus Project later reported that Pegasus was installed on the phone of Khashoggi's fiancée, Hatice Cengiz, four days after his murder, according to Forbidden Stories. NSO says its technology was not associated in any way with the murder.
• India. Court documents from the WhatsApp v. NSO Group lawsuit revealed that 100 of the 1,223 confirmed victims of NSO's 2019 WhatsApp hacking campaign were located in India, the second-highest country total after Mexico. Targets included journalists, lawyers, and activists.
• European leaders. French President Emmanuel Macron's number was among 14 heads of state listed as people of interest, but Amnesty could not forensically examine world leaders' phones, so infection is unconfirmed, and NSO denies he appeared on any client's list. In Hungary, forensic analysis confirmed that investigative journalists at Direkt36 were infected in 2019.

NSO Group consistently denies these findings and maintains its technology is used only for legitimate law enforcement. In December 2024, a US judge ruled that NSO Group breached hacking laws in the WhatsApp case, a landmark outcome after five years of litigation.

The realistic profile of a Pegasus target is someone whose communications could be politically or financially valuable to a government: journalists covering sensitive beats, human rights workers, lawyers representing dissidents, opposition politicians, and business executives in certain markets. If you don't fit that profile, the statistical likelihood of Pegasus on your device is very low. That said, understanding what to look for is still worth knowing.

Signs your iPhone may be compromised

Pegasus is built to stay hidden. Amnesty's Security Lab says spyware like this leaves little to no trace, so there is no reliable list of symptoms that proves infection.

Battery drain, a warm phone, data spikes, and crashes all have ordinary causes, and none of them is a dependable sign of Pegasus. Two things are more useful:

• An Apple threat notification. Apple sends these when it detects an attack that looks like mercenary spyware aimed at a specific person. Apple describes them as high-confidence alerts, though it can't reach absolute certainty. They appear on your lock screen, by email, and in your Apple Account. If you get one, take it seriously.
• A forensic check. The only way to know for certain is a forensic analysis of the device, which the next section covers.

How to check your iPhone for Pegasus

The most reliable detection method available to the public is the Mobile Verification Toolkit (MVT), developed by the Amnesty International Security Lab and released in July 2021 alongside the Pegasus Project investigation. MVT is open-source and free.

MVT works by analyzing an encrypted backup of your iPhone on a computer and comparing it against known indicators of compromise (IOCs): domain names, IP addresses, and file signatures that Amnesty's researchers have linked to Pegasus infrastructure. It's a forensic tool, not a consumer app, and it requires some comfort with the command line. Its maintainers describe it as a research tool for technologists and investigators, and warn that public indicators alone can't show a device is clean.

Here's the basic approach:

1. Create an encrypted iTunes backup of your iPhone on a Mac or Windows PC. Encrypted backups hold additional records, such as Safari history, that MVT can analyze.
2. Install MVT on your computer via Python (full instructions are in the MVT documentation).
3. Download the latest IOCs using the mvt-ios download-iocs command. MVT pulls indicators from Amnesty's repository and other public lists.
4. Run the analysis on your backup. MVT outputs a folder of JSON files flagging any matches to known IOCs.
5. Review the results. A flag doesn't automatically confirm infection, and a clean result doesn't prove your phone is clean, but anything flagged warrants further investigation or a consultation with a digital security expert.

MVT can also analyze a full filesystem dump, but that requires a jailbreak and is aimed at investigators.

If you'd rather not use a command-line tool, watch for an Apple threat notification, and contact Access Now's Digital Security Helpline if you think you're a target. It offers free support to journalists, activists, and civil society members.

What you can do to reduce your risk

If you're in a profession or situation that puts you on someone's potential target list, a few habits meaningfully reduce your exposure:

• Keep iOS updated. Apple patches zero-day exploits as they're discovered. Many Pegasus infection vectors have been closed by updates. Running an outdated iOS version keeps known doors open.
• Enable Lockdown Mode. Apple introduced Lockdown Mode in iOS 16 for the very few people who might be personally targeted by sophisticated attacks. Apple says it blocks most message attachment types, blocks incoming FaceTime calls unless you've called that person in the past 30 days, and makes link previews unavailable. It's meant for high-risk individuals, not everyday users, and it reduces the attack surface rather than guaranteeing protection.
• Reboot your phone regularly. Amnesty's analysis suggests recent iOS Pegasus infections no longer persist across reboots, so a restart may clear one. An attacker can still reinfect the phone, and a reboot can destroy forensic evidence, so it's a habit rather than a cure. The NSA's mobile device guidance also recommends powering your phone off and on weekly.
• Limit iMessage and FaceTime if you're at high risk. Zero-click exploits have repeatedly used iMessage as a delivery vector, and turning off iMessage and FaceTime reduces that specific attack surface, though it comes with practical trade-offs.
• Be skeptical of unexpected messages. While modern Pegasus doesn't require you to click anything, earlier delivery methods still exist, and other spyware does. Don't tap links in messages from unknown senders.

If you receive an Apple threat notification or believe you've been targeted, contact a specialist before you reset or replace your phone, since a reset can destroy forensic evidence. Organizations like Access Now's Digital Security Helpline offer free support to journalists, activists, and civil society members facing digital threats.

The bigger picture

Pegasus sits at an uncomfortable intersection of legitimate security needs and serious abuse. NSO Group's position is that its tools help catch criminals and terrorists. The record documented by Citizen Lab, Amnesty, and a consortium of journalists shows something more complicated: a technology that has repeatedly been used against journalists, activists, and politicians, not only against criminals and terrorists.

For most people, Pegasus isn't a personal threat. But the existence of tools this capable is a reason to take your digital security seriously, keep your software updated, and understand that your phone contains more of your life than any previous generation of surveillance technology could have accessed.

Conclusion

Staying informed is a form of protection, and for most people the habits that matter most are simple ones: keep iOS updated, treat an Apple threat notification (not battery drain or a warm phone) as the real warning sign, and know who to contact if you might be a target.

Guardio isn't spyware-detection software and doesn't detect Pegasus, but it covers more common risks. Browsing protection on your computer and phone blocks phishing and scam sites before they open and explains why, and Email Security flags phishing emails that get past the Gmail spam filter. On iPhone, the Text Message Filter sends malicious texts to junk. No tool catches everything.

Get a free security scan with Guardio today and stay protected from phishing.