What Pegasus Can Extract: Complete Device Compromise

According to Citizen Lab and Amnesty International analyses, Pegasus spyware can extract virtually all data from a compromised device, including messages from encrypted apps like Signal and WhatsApp, call recordings, location history, photos, contacts, calendar entries, and browsing history. The spyware can activate the device's camera and microphone for real-time surveillance. Pegasus reportedly exploited zero-day vulnerabilities in iOS and Android, requiring no user interaction — a simple iMessage or WhatsApp call could deliver the payload without the target answering. Apple issued emergency security patches multiple times to address Pegasus exploits, and WhatsApp sued NSO Group in 2019 for exploiting a calling vulnerability to infect 1,400 devices.

nso-group has been the subject of increasing scrutiny over its data collection practices practices. Privacy researchers and regulatory bodies across multiple jurisdictions have documented concerns about how the company handles user data, particularly regarding consent, transparency, and data minimization principles. The findings suggest a pattern of prioritizing business metrics over user privacy, a trend observed across the broader technology industry. Users affected by these practices have limited recourse without proactive intervention such as filing formal complaints with data protection authorities or submitting DSAR requests.

Regulatory responses have varied significantly. European data protection authorities have been more aggressive in enforcement under GDPR, while US enforcement remains fragmented across state-level privacy laws. The investigation highlights the need for stronger federal privacy legislation and more transparent corporate data practices. Affected users should consider reviewing their privacy settings, submitting data deletion requests, and exploring privacy-preserving alternatives recommended by independent researchers.