What is Pegasus Spyware?

Pegasus Spyware

malware OpenTrojan Threat Intelligence Updated 2026-08-26

Mobile devices (iOS/Android); targeted zero-click surveillance

Source Attribution

Origin: MITRE
Source: Citizen Lab · Amnesty Tech Lab
Reviewer: Phase 44E review
Verified: 2026-08-26T15:16:26.825Z
Confidence: high

Source: Citizen Lab · Amnesty Tech Lab · Verified: 2026-08-26T15:16:26.825Z · Confidence: high

Security Timeline

2016-08 discovered Pegasus reported via NSO-linked clients
2021-07 updated iMessage zero-click exploit published (FORCEDENTRY)

Quick Answer

Pegasus gains device access via link/zero-click exploits and remotely collects messages, contacts, location and device media.

Definition

Pegasus is a commercial mobile spyware by NSO Group used for targeted surveillance, historically including zero-click exploits for iOS and Android.

Overview

Pegasus is a commercial mobile spyware by NSO Group used for targeted surveillance, historically including zero-click exploits for iOS and Android.

Behavior

Zero-click iOS/Android exploits
Undetectable remote monitoring
Documented by Citizen Lab/Amnesty

First Seen

2016-08

Target

Mobile devices (iOS/Android); targeted zero-click surveillance

Techniques: T1471, T1419, T1429
Campaigns: n/a
Related CVEs: CVE-2021-30860, CVE-2020-27930

Malware Intelligence

Family: Pegasus Spyware

Aliases: Pegasus, NSO Group Pegasus

Techniques: T1471, T1419, T1429

Targets: Mobile devices (iOS/Android); targeted zero-click surveillance

Behavior:

Zero-click iOS/Android exploits
Undetectable remote monitoring
Documented by Citizen Lab/Amnesty

References

https://citizenlab.ca/2018/09/hidden-cobra-turla/

Have a follow-up question?

Ask OpenTrojan's evidence-backed assistant about this topic — answers cite their sources.

Ask AI about this Start an investigation

Start Investigation

Move from reading to investigating Pegasus Spyware. The workspace is a structured analysis surface — not a chat — organised as:

Question — what do you need to know about Pegasus Spyware?

Evidence — assertions mapped to verifiable references.

Timeline — events in chronological order.

Related Entities — CVE, threat actor, campaign, malware links.

Sources — NVD, CISA KEV, MITRE ATT&CK, vendor advisories.

Notes — your own observations and working hypotheses.

AI assistance is limited to summarising, explaining, and suggesting related evidence. AI never completes your investigation, modifies entity relationships, or generates facts — all published analysis stays human-reviewed.