The Pegasus spyware from the Israeli company NSO Group has been used in attempts and successful hacks of 37 mobile phones from journalists, activists and business leaders around the world. This is what The Washington Post and media partners like Le Monde, The Guardian and Süddeutsche Zeitung report on the basis of their own research. The tech company denies.
One of the findings is that the spyware was used to grab the smartphones of both the wife and fiancé of the murdered Saudi columnist Jamal Khashoggi. Their phone numbers appeared on a list of more than 50,000 numbers that researchers believe were possible targets for surveillance by governments using Pegasus.
The list also includes phone numbers from more than 180 journalists from news organizations such as CNN, AP, Voice of America, The New York Times, The Wall Street Journal, Bloomberg News, Le Monde, The Financial Times and Al Jazeera. The media consortium that conducted the research, led by Paris-based non-profit Forbidden Stories, said the evidence comes from the phones through digital forensic analysis by Amnesty Internationals security lab.
Pegasus, sold to selected governments and search services, can link to hack mobile phones and secretly record emails, calls, and text messages. In some cases, it can activate itself without the victim clicking on the link, says The Post. It is not known how many phones on the list were targeted or were spied on, according to the U.S. newspaper.
In response to the findings of the consortium, NSO denied that its technology was being used against Khashoggi and said the investigation contained flawed assumptions and factual errors. “These allegations are so outrageous and far from the reality that the NSO is considering a defamation lawsuit,” said the Israeli company.
Last month, the NSO Group published its first annual Transparency and Responsibility Report, which states that its products have been used by states to thrive major terrorist attacks and dismantle drug trafficking circles.
More findings of the investigation will be announced in the next three days, according to The Post.