Pegasus Spyware Global Expansion: Government Clients Targeting Journalists Worldwide

NSO Group's Pegasus spyware continued to expand globally despite sanctions and lawsuits, with new investigations revealing government clients using the tool to target journalists, opposition politicians, human rights defenders, and lawyers across dozens of countries. Pegasus can silently infect smartphones through zero-click exploits requiring no user interaction, gaining complete access to messages, emails, photos, location data, microphone, and camera. Apple sent threat notifications to targeted individuals in over 150 countries. The Pegasus Project investigation identified at least 50,000 phone numbers selected for potential surveillance by NSO clients. Targets included journalists investigating government corruption, opposition candidates during elections, and human rights lawyers representing political dissidents. Despite being sanctioned by the US Commerce Department and facing lawsuits from Apple and WhatsApp, NSO Group continued operating and reportedly found new government customers. The spyware represented the industrialization of government surveillance, making nation-state capabilities available to any government willing to pay.

The ramifications of this incident extend beyond the immediate data exposure. Privacy regulators in multiple jurisdictions have opened investigations, and affected individuals are organizing collective action to demand accountability and meaningful remediation. The case highlights systemic weaknesses in how organizations handle personal data and the gap between corporate privacy promises and operational reality.

For impacted individuals, immediate action is critical. Filing a data subject access request forces the company to disclose exactly what data they hold about you, providing the foundation for deletion requests, regulatory complaints, and potential legal action. Below, we outline the specific data types at risk and the concrete steps you can take to protect yourself.