The pegasus business

what is the Pegasus business

Pegasus was discovered thanks to Ahmed Mansoor, a UAE human rights activist, who happened to be one of its targets. It was a spear-phishing attack: He received several SMS messages that contained what he thought were malicious links, so he sent those messages to security experts from Citizen Lab, and they brought another cybersecurity firm, Lookout, to the investigation.

Mansoor was right. If he had clicked, his iPhone would have been infected with malware — malware for iOS. For non-jailbroken iOS, to be precise. The malware was dubbed Pegasus, and Lookout researchers called it the most sophisticated attack they’d ever seen on any endpoint.

Pegasus has been attributed to the NSO Group, an Israeli company whose bread and butter is developing spyware. That means the malware is commercial — it’s sold to whoever is willing to pay for it. Pegasus relied on a whopping three zero-day (previously unknown) vulnerabilities in iOS that allowed it to silently jailbreak the device and install surveillance software. Another cybersecurity firm, Zerodium, once offered $1 million for an iOS zero-day, so you can imagine that it cost quite a bit of money to create Pegasus.