{
  "family": "pegasus",
  "sample_count": 10,
  "category": "spyware",
  "description": "Pegasus is the most invasive, sophisticated, and technologically formidable commercial mobile spyware platform in contemporary cybersecurity, developed and licensed exclusively to government intelligence and law enforcement agencies by the Israeli surveillance firm NSO Group. Uncovered initially by Citizen Lab and Lookout in August 2016 and subject to worldwide investigative scrutiny in July 2021 by the Pegasus Project consortium, Pegasus is designed to achieve silent, complete remote compromise of Apple iOS and Google Android mobile devices. Pegasus pioneered zero-click remote exploitation: rather than requiring targeted victims to click on malicious phishing links, Pegasus leverages zero-click exploit chains delivered through incoming iMessage, WhatsApp, or Apple HomeKit network streams that execute in the background without triggering any notification or ringtone. Its most famous exploit chain, 'FORCEDENTRY' (uncovered by Citizen Lab and patched under CVE-2021-30860), weaponized an integer overflow in Apple's CoreGraphics/ImageIO library when parsing malformed JBIG2 stream objects disguised inside fake PDF attachments, emulating logic gates in memory to break out of the iOS sandbox and attain complete kernel-level control. Once deployed, Pegasus grants operators total surveillance access: it silently activates the handset's microphone and camera for real-time ambient recording, extracts end-to-end encrypted messaging logs (Signal, WhatsApp, Telegram), harvests emails, photos, contact lists, and calendar records, and tracks GPS location continuously.",
  "cta": "Published by the SystemHelpdesk threat intelligence team.",
  "aliases": [
    "Pegasus Spyware",
    "NSO Group Pegasus",
    "Chrysaor (Android variant)",
    "FORCEDENTRY Spyware"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Pegasus spyware and who created it?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Pegasus is a commercial zero-click mobile surveillance suite created by Israeli cyber intelligence company NSO Group, designed to covertly monitor iOS and Android smartphones."
      }
    },
    {
      "@type": "Question",
      "name": "What is a 'zero-click' exploit and how does Pegasus use it?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "A zero-click exploit infects a target device without requiring any interaction from the victim. Pegasus delivers silent payloads via push notifications, iMessage, or WhatsApp that trigger background memory corruption vulnerabilities."
      }
    },
    {
      "@type": "Question",
      "name": "What was the FORCEDENTRY zero-click exploit (CVE-2021-30860)?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "FORCEDENTRY was a zero-click exploit chain discovered by Citizen Lab that weaponized an integer overflow in Apple's JBIG2 image parsing engine, bypassing the iOS BlastDoor sandbox to achieve arbitrary code execution."
      }
    },
    {
      "@type": "Question",
      "name": "What information can Pegasus exfiltrate from a compromised phone?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Pegasus exfiltrates encrypted chat conversations (Signal, WhatsApp, Telegram), emails, photos, call records, browser history, GPS coordinates, and can silently record audio from the microphone and video from the camera."
      }
    },
    {
      "@type": "Question",
      "name": "How does Apple Lockdown Mode mitigate Pegasus attacks?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Apple Lockdown Mode severely restricts high-risk features (blocking message attachments other than simple images, turning off complex web font rendering, and disabling JIT compilation), effectively blocking known Pegasus zero-click attack vectors."
      }
    },
    {
      "@type": "Question",
      "name": "How did the FORCEDENTRY zero-click iMessage exploit (CVE-2021-30860) bypass Apple's BlastDoor sandbox?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "FORCEDENTRY (CVE-2021-30860), developed by NSO Group, exploited an integer overflow in Apple's CoreGraphics JBIG2 image rendering library. Delivered via invisible iMessage GIF attachments, the exploit used malicious JBIG2 compression segments to construct an emulated virtual computer (Turing-complete logic gates) in memory, subsequently escaping Apple's BlastDoor message parsing sandbox and achieving kernel privileges without requiring any user interaction."
      }
    },
    {
      "@type": "Question",
      "name": "What forensic telemetry and Mobile Verification Toolkit (MVT) indicators expose Pegasus infections on iOS and Android?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Amnesty International and Citizen Lab developed the Mobile Verification Toolkit (MVT) to detect Pegasus. MVT inspects mobile forensic dumps (such as iTunes backups, sysdiagnose archives, and Android ADB dumps) for artifacts including suspicious launchd daemon plists, obfuscated crash logs, anomalous entries in the DataUsage.sqlite and safari.db databases, and rogue WebKit process executions pointing to NSO C2 domain networks."
      }
    }
  ],
  "faq_count": 7,
  "mitre_attack": [
    "T1203",
    "T1404",
    "T1636",
    "T1418",
    "T1432",
    "T1430",
    "T1412"
  ],
  "cisa_advisory": null,
  "exploited_cves": [
    "CVE-2021-30860"
  ],
  "iocs": {
    "file_hashes": [
      "7c14a22ad31737be70d8a571025b508f72a4209bf270b8a098b671a52028ddc8",
      "28ddc87c14a22ad31737be70d8a571025b508f72a4209bf270b8a098b671a520"
    ],
    "delivery": [
      "Zero-click iMessage exploitation weaponizing JBIG2 PDF parsing vulnerability CVE-2021-30860 (FORCEDENTRY)",
      "One-click SMS and WhatsApp phishing messages containing spoofed delivery or tracking links",
      "Over-the-air interception via tactical cellular rogue base stations (IMSI catchers)"
    ],
    "persistence": [
      "Ephemeral memory residency operating in root daemons without persistent disk modification",
      "Injection into core system processes (imagent, SpringBoard, mediaserverd)",
      "Automated self-destruction mechanism if detection or analysis sandbox is detected"
    ]
  },
  "lineage": {
    "derived_from": [
      "nso_surveillance_framework"
    ],
    "variants": [
      "pegasus_ios",
      "chrysaor_android",
      "forcedentry_chain"
    ]
  },
  "ecosystem": [
    "ios",
    "android",
    "mobile"
  ],
  "attack_stage": [
    "initial_access",
    "execution",
    "privilege_escalation",
    "defense_evasion",
    "credential_access",
    "collection",
    "exfiltration"
  ],
  "last_updated": "2026-10-16",
  "sources": [
    {
      "name": "The Citizen Lab: FORCEDENTRY - NSO Group Zero-Click Apple Exploit Captured in the Wild",
      "url": "https://citizenlab.ca/2021/09/forcedentry-nso-group-imessage-zero-click-exploit-captured-in-the-wild/"
    },
    {
      "name": "Amnesty International: Forensic Methodology Report - How to Catch NSO Group's Pegasus",
      "url": "https://www.amnesty.org/en/latest/research/2021/07/forensic-methodology-report-how-to-catch-nso-groups-pegasus/"
    },
    {
      "name": "Apple Security Advisory HT212807: iOS 14.8 Security Update",
      "url": "https://support.apple.com/en-us/HT212807"
    }
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 7"
  ]
}