Pegasus malware NSO Group

on august 25, 2016, citizen lab , lookout revealed malware known pegasus, created company, being used target human rights activist ahmed mansoor in united arab emirates. mansoor internationally recognized human rights activist , 2015 martin ennals award laureate. informed citizen lab researchers bill marczak , john scott-railton iphone 6 had been targeted on august 10, 2016, means of clickable link in sms text message.

analyses citizen lab , lookout discovered link downloaded malware exploited 3 unknown , unpatched zero-day vulnerabilities in iphone s operating system ios. according analyses, malware can silently jailbreak iphone when victim, through spear phishing, sent , opens malicious url. after user opens link, malware installs on phone, collecting communications , locations of targeted iphones including imessage, gmail, viber, facebook, whatsapp, telegram , skype communications. malware can collect wi-fi passwords. researchers noticed malware s code referenced nso group product called pegasus in leaked marketing materials. pegasus had come light in leak of records italian company hacking team, when said have been supplied government of panama. researchers found mexican journalist, rafael cabrera, had been targeted , there evidence malware have been used in israel, turkey, thailand, qatar, kenya, uzbekistan, mozambique, morocco, yemen, hungary, saudi arabia, nigeria, , bahrain.

citizen lab , lookout notified apple s security team. apple patched flaws within ten days , released update ios. patch macos released 6 days later.

in 2017, citizen lab researchers revealed nso exploit links had been sent mexican scientists , public health campaigners. targets supported measures reduce childhood obesity, including mexico s soda tax.

in july 2017, international team assembled investigate 2014 iguala mass kidnapping publicly complained being surveilled mexican government. argue mexican government utilized pegasus send them messages funeral homes contained links which, when clicked, granted government ability surreptitiously listen investigators. mexican government has repeatedly denied unauthorized hacking despite existence of strict rules guarding program being used non-governmental entities.