The Demon Pegasus, the Winged Horse Without a Click

Legend

Commercial spyware sold by Israel's NSO Group to governments, able to fully compromise iPhones and Android phones, often with exploits needing no click. Investigations by Citizen Lab and Amnesty documented its use against journalists, activists and politicians. In December 2024 a US federal court found NSO liable for attacking WhatsApp users.

Exorcism

Cast it out by updating the phone promptly and rebooting it often. People at risk can enable iOS Lockdown Mode and turn to organisations such as Access Now or Amnesty for a check.

Technical record

Circle: Circle V · State espionage
First seen: 2016
Status: Active
Weapons (exploited CVEs): Saint FORCEDENTRY, Who Forced the Door With a PDF · Saint BLASTPASS, Who Entered Without a Click

Commercial spyware sold by Israel's NSO Group to governments, capable of fully compromising iPhones and Android phones, often through zero-click exploits. Investigations by Citizen Lab and Amnesty documented its use against journalists, activists and politicians. A US federal court found NSO liable for hacking WhatsApp users in December 2024; a jury set damages in May 2025.

Sources: attack.mitre.org · attack.mitre.org · citizenlab.ca · MITRE ATT&CK reference S0289