Meet Pegasus, the spyware that infects phones

Lately, the Pegasus spyware has become one of the stories causing the biggest stir across the media, and it is putting the Spanish government under great pressure since it emerged that Catalan pro-independence leaders such as Roger Torrent and Ernest Maragall have been spied on through their mobile phones.

What exactly is Pegasus?

Pegasus is a type of spy app that has been deployed to spy on various high-level political figures with the aim of obtaining information from them through their mobile phones. This software is a very effective tool and, according to NSO Group, the company that developed this spyware, it is sold only to governments. 

It was created to help governments prevent terrorist attacks and break up paedophile, sex-crime and drug-trafficking gangs. So far, it cannot be confirmed that the spying on Spanish and pro-independence politicians was carried out with this tool.

But how does it actually work?

This application is installed on mobile devices through a link or by exploiting a vulnerability in the phone’s operating system. Once installed, the application stays in the background and can remotely spy on everything we do with the device.

For example, the attacker can see all text messages and phone calls, access photographs and apps, obtain passwords and locate the device’s GPS position.

How does Pegasus infect mobile devices?

The first thing to bear in mind is that this spyware is installed on mobile devices by exploiting weaknesses in the operating system. These vulnerabilities are exploited before IT specialists or developers have even discovered them, which is why, once found, they must be reported or fixed immediately to prevent possible attacks. If we fail to identify them, cybercriminals can exploit them to deceive people and thus gain access to their mobile phones.

It is worth noting that exactly how it infects devices is not entirely clear, as we do not yet have enough information about how the spyware works. Even so, it is believed that phones can be infected through links sent via SMS, through WhatsApp phone calls or over iMessage.

How can we detect whether our Android or iOS phone is infected?

There is a way to find out whether this spyware has been used on our mobile device, Android or iOS: the Mobile Verification Toolkit. This tool was designed exclusively to trace disguised messages or IP addresses originating from NSO Group.

How do you use the Mobile Verification Toolkit?

First, we connect our mobile device to a computer. Through this connection, the tool saves a backup of the device’s data and then scans it to check whether the device really has been infected by the Pegasus spyware. Either way, it tells the user whether their device has been compromised by this malware.

How does Pegasus work?

Pegasus is able to remotely activate the camera and microphone, scan emails and messages and store all kinds of data, such as the location of mobile devices. According to cybersecurity experts, the most dangerous thing about this spyware is that it can be installed on our phone without any interaction on our part.

One of the best-known Pegasus cases was the attack on WhatsApp in 2019. The attack stemmed from a vulnerability in the app that came to light, and as a result an English human rights lawyer was targeted by the spyware. But that was not all: this cyberattack led to thousands of mobile devices being hacked within 48 hours.

Want to keep up with the Pegasus case? Read more