Inside Pegasus: How Governments Use Spyware

Pegasus, Predator, and Hermit: Inside the World of Government Spyware

Imagine your smartphone suddenly transforming into a surveillance device – the camera watching you, the microphone recording your conversations, and every message or email quietly forwarded to an unknown observer. This isn’t science fiction; it’s the reality of government spyware. In recent years, a wave of revelations has exposed how sophisticated spyware tools like Pegasus have been covertly used by governments to monitor people’s phones on a global scale. This investigative overview will explain what government spyware is, delve into notorious examples (Pegasus and its newer counterparts Predator and Hermit), examine notable cases of abuse, and discuss how these spyware infect devices, who gets targeted, the controversies surrounding their use, and ways to protect yourself.

What is Government Spyware?

Government spyware refers to malicious software designed for state-level surveillance. These tools – often developed by private “cyber-arms” firms and sold to governments – can infiltrate a target’s phone or computer to steal information and monitor activity without the user’s knowledge. Once installed, advanced spyware essentially hands over full control of the device to the operator. For example, Pegasus (one of the most infamous spyware programs) can read text messages, intercept calls, collect passwords, track GPS location, and secretly activate the phone’s camera and microphone. In practice, the victim’s smartphone is turned into a 24/7 surveillance tool.

These spyware tools are sometimes called “lawful intercept” technology – purportedly sold for fighting crime and terrorism. Companies like the Israel-based NSO Group (maker of Pegasus) or Italy’s RCS Lab (maker of Hermit) insist they only supply their spyware to legitimate government agencies for use against criminals. However, investigations by cybersecurity researchers and journalists have revealed a very different reality: authoritarian governments worldwide have routinely abused such spyware to surveil journalists, human rights defenders, lawyers, opposition politicians, and other members of civil society. In essence, these commercial surveillance tools have become a global espionage weapon, often deployed not against terrorists or criminals, but against critics of regimes or even rival political figures.

Notably, the industry has expanded from a handful of vendors to an entire ecosystem of spyware providers. Google’s Threat Analysis Group, which tracks these “surveillance-for-hire” companies, says it is following more than 30 spyware makers offering their services to government clients. In other words, Pegasus is just the tip of the iceberg. Below, we examine Pegasus and two other prominent spyware tools – Predator and Hermit – to see how they work and how they’ve been used.

Pegasus: The Infamous Spyware Weapon

Pegasus is the best-known example of government spyware, often making headlines for its audacious capabilities and misuse. Developed by the Israeli firm NSO Group since 2011, Pegasus is a covert spyware suite that can be installed on both Apple iOS and Android phones. NSO Group markets Pegasus as a tool for law enforcement and counterterrorism, but in practice its deployment has been far from limited to criminals. As one report noted, governments around the world have used Pegasus to secretly surveil journalists, lawyers, political dissidents, and human rights activists.

What makes Pegasus so notorious is its extraordinary stealth and power. The spyware can be implanted remotely and grants near-total access to the infected phone. Pegasus operators can read the target’s messages and emails, listen to phone calls, siphon photos and contacts, and even turn on the device’s camera or microphone to eavesdrop in real time. All of this happens without the victim’s awareness – Pegasus hides itself and even can self-destruct if needed to conceal its presence. In one documented case, Pegasus was silently installed via a simple WhatsApp call that the target didn’t even need to answer. More recently, Pegasus has exploited vulnerabilities in Apple’s iMessage to infiltrate iPhones with zero-click attacks, requiring no taps or actions from the user. By 2020, NSO had largely shifted Pegasus to these zero-click exploits and network-based attacks, allowing infection without any user interaction.

Pegasus came to global attention through a series of high-profile investigations. In 2021, a consortium of media outlets and Amnesty International’s Security Lab (in what became known as the Pegasus Project) analyzed a leaked list of 50,000 phone numbers believed to be selected for Pegasus targeting by NSO’s clients. The numbers included hundreds of journalists, human rights activists, lawyers, businesspeople, and even dozens of politicians and heads of state. For example, at least 180 journalists worldwide were identified as potential Pegasus targets. Notably, the family and associates of Jamal Khashoggi (the murdered Saudi journalist) were reportedly targeted with Pegasus – including his fiancée in the months around his death. Other cases span the globe: Mexican journalists and anti-corruption activists, Rwandan dissidents, Indian opposition leaders, Hungarian media figures, and many more have had Pegasus allegedly deployed against them by various governments. The pattern is clear – Pegasus has often been abused under the guise of national security to monitor critics and perceived opponents of those in power.

The revelations around Pegasus sparked intense backlash. Lawsuits have been filed against NSO Group by tech companies like Apple and WhatsApp (Facebook) for exploiting their platforms to spread Pegasus. In late 2021, the U.S. government blacklisted NSO Group, placing it on a trade restriction list for engaging in “malicious cyber activities” contrary to U.S. foreign policy interests. Despite these actions, Pegasus remains in use by some clients, and NSO claims it has internal safeguards – though evidence suggests those safeguards have been largely ineffective at preventing abuse. Pegasus’s story has highlighted how dangerous and unaccountable commercial spyware can be, and it set the stage for scrutiny of other players in this secretive industry.

Predator: The New Spyware on the Block

As Pegasus grabbed headlines, other companies quietly developed their own potent spyware. One such tool is Predator, a spyware suite developed by a company called Cytrox (reportedly based in North Macedonia and linked to an alliance of surveillance firms called Intellexa). Predator first came to light in late 2021 when Citizen Lab researchers discovered it on the phone of an exiled Egyptian politician. In an alarming twist, that phone was simultaneously infected with both Cytrox’s Predator and NSO’s Pegasus – each controlled by different government clients. This case showed that multiple governments were hacking the same target with competing spyware products.

Predator is similar to Pegasus in that it can target both Android and iOS devices, and once inside a phone it can fully surveil the user’s communications and data. Analyses indicate that Predator can access the microphone, camera, contacts, text messages, and messaging apps (like WhatsApp, Telegram, Signal), and even intercept or fake messages on the device. Essentially, Predator can do everything Pegasus can – from tracking the phone’s location to stealing sensitive files – making the victim’s smartphone an open book.

What sets Predator apart is some of its technical approach. It reportedly works in tandem with a component called “Alien” that helps the spyware gain a foothold and execute commands on the device. In one assessment by Google in 2022, Predator was found to bundle five exploits, including zero-day (previously unknown) vulnerabilities, to penetrate devices. In other words, Predator has been equipped with fresh hacking tricks to defeat even up-to-date phones. Citizen Lab found that in a 2021 case, Predator infected an iPhone by sending the target a single-click malicious link via WhatsApp – once the link was clicked, the spyware took root, even managing to persist after the phone was rebooted by abusing an iOS feature.

Predator’s use has now been traced to multiple countries. Researchers scanning Predator’s command-and-control servers in late 2021 found likely government users in Armenia, Egypt, Greece, Indonesia, Madagascar, Oman, Saudi Arabia, and Serbia, among others. One of the most explosive Predator scandals emerged in Greece in 2022, where journalists and opposition politicians were reportedly found to have been surveilled with Predator spyware, sparking a national political scandal often dubbed the “Greek Watergate.” In one confirmed case, a financial journalist in Greece received a phishing text that lured him to download Predator, allowing someone to monitor his calls and messages. Another notable target was an Egyptian opposition figure, Ahmed Eltantawy, who in 2023 announced plans to run for president; within weeks, he was barraged with SMS messages containing links that would install Predator, suggesting Egyptian authorities sought to spy on him. These incidents, along with investigations by European media (the Predator Files project), revealed that Predator has been sold to at least 25 countries across Europe, Africa, Asia, and the Middle East – including some EU states and repressive regimes alike.

The U.S. government has taken notice as well. In 2023, the U.S. Treasury sanctioned several companies and individuals linked to the Predator/Intellexa network for enabling authoritarian governments to conduct spyware campaigns. Like Pegasus, Predator is now under heavy scrutiny for its role in the proliferation of unchecked digital surveillance.

Hermit: Spyware in the Shadows

Another spyware uncovered in recent years is Hermit, a surveillance tool developed by the Italian firm RCS Lab. Hermit remained relatively under the radar until mid-2022, when security teams from Google and the mobile security company Lookout both published findings about it. Described as “enterprise-grade” spyware, Hermit has been used by state actors in at least a few countries so far – most notably Kazakhstan and Italy, with signs of deployment in parts of Syria as well.

Hermit’s capabilities are comparable to Pegasus and Predator. It can monitor calls and messages, track device location, pilfer photos and contacts, record audio, and even gain root control over Android phones (deep access to the operating system). In short, once Hermit infects a phone, the spyware’s operator can do almost anything on the device that the owner can – and more. Lookout’s investigators, who analyzed Hermit’s code, found it to be a modular spyware: the initial infection loads a small agent, which then downloads additional components to expand its spying functions. This modular design helps Hermit hide its malicious parts until after it’s installed, making it harder to detect at first.

What makes Hermit particularly interesting (and chilling) is how it infects devices. Unlike Pegasus, which often uses invisible exploits, Hermit has been deployed with social engineering tricks. Attackers have masqueraded as mobile telecommunication companies to fool targets into installing Hermit. In one elaborate scheme observed by Google, the attackers actually worked with local internet service providers to disable a target’s mobile data, then sent an SMS with a link to a fake app that promised to “restore” connectivity. The fake app appeared to be from the target’s real mobile carrier (for instance, a bogus “My Vodafone” app), lending it credibility. When the victim followed the link and installed the app, Hermit spyware was delivered. In some cases, Hermit operators even obtained Apple enterprise certificates to sign their malicious iOS app, abusing Apple’s program meant for internal corporate apps to sidestep the App Store’s security screening. (Apple later revoked those certificates once Hermit was exposed, and Google pushed security updates to Android users.)

These infection methods show the extreme lengths spyware actors will go to implant their malware on a target’s phone. Hermit’s use by governments also illustrates how spyware has spread beyond a single company. According to Lookout, RCS Lab has been operating for decades in the same surveillance tech market as NSO Group and others. It was known for traditional wiretapping technology and has now adapted to smartphone spyware. RCS Lab marketed Hermit as a lawful intercept tool, and Italian authorities allegedly used it during a 2019 anti-corruption investigation. However, evidence from Kazakhstan in 2022 showed Hermit being used after the government’s violent crackdown on protesters – suggesting it was deployed to monitor and stifle dissent. Once again, a tool sold for “lawful” use found its way into political abuse. Hermit may not have the same name recognition as Pegasus, but it underscores that the market for mercenary spyware is diverse – and growing.

Notable Cases of Spyware Abuse

Government spyware has been involved in numerous scandals and human rights violations over the past decade. Here are a few notorious cases that highlight the issue:

The Pegasus Project (2021): A global media investigation revealed that tens of thousands of phone numbers – including those belonging to activists, journalists, lawyers, business executives, and several heads of state – were selected as potential targets of NSO Group’s Pegasus spyware. forensic analyses confirmed many devices had been infected. This leak exposed widespread abuse of Pegasus by multiple governments, from Azerbaijan to Morocco to India, far beyond its purported use against criminals.
Jamal Khashoggi Affiliates (2018): After Saudi journalist Jamal Khashoggi was murdered, investigators discovered that several people close to him were targeted with Pegasus. Citizen Lab reported that a Saudi Pegasus operator it codenamed “KINGDOM” had tried to infect Khashoggi’s associate Omar Abdulaziz (a Saudi dissident in Canada) and had successfully infected the phone of Khashoggi’s fiancée, Hatice Cengiz. These findings strongly suggest Pegasus was used as a tool against individuals linked to a regime critic, even around the time of his assassination.
Mexico’s Civil Society (2016–2017): Mexico became an early example of Pegasus misuse. Investigations (by Citizen Lab and Mexican NGOs) found that journalists, anti-corruption activists, public health campaigners, and even international investigators in Mexico were targeted with Pegasus spyware sent via SMS lure messages. One notorious case involved spyware texts sent to the adolescent son of a journalist, in an attempt to bait the mother’s phone. The Mexican government had bought Pegasus ostensibly to fight drug cartels, but it was turned against civil society. These revelations caused public outrage and calls for accountability in Mexico.
Greece’s Predator Scandal (2020–2022): In Greece, the use of Predator spyware against journalists and opposition politicians led to a major political scandal. For instance, an investigative journalist, Thanasis Koukakis, discovered his phone had been surveilled by Predator for months. Additionally, the leader of an opposition party was reportedly targeted. The scandal led to resignations within the Greek government and an ongoing inquiry, highlighting how a European Union country became entangled in the spyware abuse saga.
Kazakhstan Protest Surveillance (2022): After mass protests erupted in Kazakhstan in January 2022, evidence emerged that the government deployed Hermit spyware to surveil participants and critics of the regime. Lookout researchers found Hermit deployed on devices in Kazakhstan in the months following the unrest. This case is emblematic of how regimes under internal pressure reach for advanced spyware to keep tabs on dissenters.

Each of these cases, among many others, demonstrates a common theme: tools sold for “security” often end up being used as tools of repression. The fallout from these revelations has put intense pressure on spyware vendors and the governments that use their products.

How Spyware Infects Devices: Tactics of Infiltration

One frightening aspect of modern spyware like Pegasus is the variety of infection methods they employ – often designed to bypass typical security measures and user caution. Here are the primary tactics these spyware programs use to penetrate phones:

Zero-Click Exploits: The most insidious attacks require no action from the target at all. So-called zero-click exploits take advantage of software vulnerabilities to deliver spyware via avenues like instant messages or calls. For example, Pegasus has used zero-click attacks through Apple’s iMessage service and previously via WhatsApp calls. Simply receiving a certain message or call – even one you never see or answer – can silently install the spyware. As Human Rights Watch’s crisis director, Lama Fakih, who was targeted by Pegasus, explained: “I didn’t have to do anything like click on a link for the attack to begin. There’s just no way to prevent an attack like this”. This makes zero-click attacks especially dangerous, as even the most vigilant user cannot easily defend against them.
One-Click Phishing Links: Earlier generations of spyware (and still some campaigns today) rely on spear-phishing messages – texts or emails with a malicious link that the target is tricked into clicking. The link might be cleverly crafted to appear legitimate (for instance, a message about a breaking news story or a personal interest of the target). If the target clicks, the spyware is surreptitiously downloaded. Citizen Lab documented cases where Pegasus operators sent SMS messages tailored to a journalist’s interests (such as a fake message about an article on Saudi Arabia sent to a New York Times reporter). Predator spyware has also been delivered via one-click links sent through WhatsApp or SMS. This method relies on social engineering – convincing the user to open something they shouldn’t – and while it’s less slick than zero-click, it has proven alarmingly effective when the bait is convincing.
Trojanized Apps (Fake Apps): Some spyware is spread by disguising it as a legitimate application, a tactic used notably by Hermit. Attackers may send a link urging the target to install an app for a plausible purpose – e.g., a security update, a messaging app, or a mobile carrier utility. In reality, the app is the spyware in disguise. As discussed, Hermit was deployed through a fake My Vodafone app to trick users into installing it. In some cases, attackers even partner with local telecom companies or use their infrastructure to make the ruse more believable (such as cutting off a user’s service, then sending a “fix” app). While Apple and Google generally block malware-laden apps from their official stores, spyware operators find ways around this – like abusing Apple’s Enterprise Developer certificates to sideload apps outside the App Store’s scrutiny. On Android, they may simply ask the user to allow installing from “unknown sources.” Once the fake app is installed, the spyware payload deploys.
Exploiting Device Backups/Connections: Some spyware may infect phones when they are connected to computers or accessories. For instance, certain iPhone exploits can run when the device is connected to a compromised charging station or computer (though this is less common for Pegasus-class spyware). Apple’s new Lockdown Mode notes that it blocks wired connections to a computer when the phone is locked, hinting at this vector. Additionally, spyware might infiltrate via backup files or cloud services if an attacker gains access to those – however, those methods typically require the attacker to already have some foothold (not the primary mode of infection).
Physical Installation and Other Methods: In extreme cases, if remote infection fails, attackers might resort to physical access. Pegasus documentation reportedly mentioned that if other avenues didn’t work, the spyware could be installed by getting close to the target – for instance, using a wireless transceiver near the person or manually installing it if they could seize the device briefly. While this is a high-risk approach for the attacker, it shows that determined operators have a playbook for almost every scenario.

Once spyware has found a way in, it typically gains privileged access by exploiting system flaws (often zero-day vulnerabilities, which are security holes unknown to the device manufacturer at the time). The end result is the spyware can run silently in the background and communicate with its controllers over the internet, sending back the user’s private data and obeying covert commands.

Who Are the Targets and Why?

Spyware like Pegasus, Predator, and Hermit might be cutting-edge technology, but the people targeted by these tools are often ordinary individuals who find themselves at odds with powerful interests. Journalists, for instance, are prime targets – especially those investigating government corruption, crime, or human rights abuses. At least 180 journalists worldwide were selected as Pegasus targets according to the Pegasus Project leak, making clear that news reporters and editors are high on the list of those whom some governments wish to monitor. By infecting a journalist’s phone, authorities can sniff out their sources, monitor their communications, and preemptively counter sensitive stories. In a number of countries, investigative journalists have been targeted just as they probed ruling elites (as happened to reporters in Mexico, Hungary, India, and elsewhere).

Human rights defenders and activists are another group heavily targeted. These individuals often work to hold governments accountable or mobilize citizens, which can put them in the crosshairs of repressive regimes. Human Rights Watch reported that one of its own senior staff members was repeatedly targeted with Pegasus – a case that “fits a pattern of abuse… in which governments use commercial spyware to silence critics”. Activists campaigning for minority rights, environmental protection, or democracy reforms have likewise been selected for spyware attacks by authorities nervous about their advocacy.

Opposition politicians and government critics frequently end up on the target list as well. Authoritarian governments (and even some ostensibly democratic ones) have deployed spyware to gain an edge over their political opponents. The Greek Predator scandal saw an opposition party leader targeted, raising obvious concerns about election integrity. In Spain, dozens of Catalan independence leaders and activists were found to have been targeted by Pegasus in what was dubbed “Catalangate” in 2022. Even sitting heads of state have not been entirely immune – for instance, the Pegasus Project reporting indicated that phone numbers for figures like French President Emmanuel Macron and Pakistani Prime Minister Imran Khan appeared in the leaked data as potential targets (though their devices were not forensically examined).

Lawyers, diplomats, and business figures have also been targeted in some cases. Lawyers representing opposition figures or investigating state abuses can be seen as impediments by authorities, and spyware offers a way to breach attorney-client confidentiality. Diplomats and international organization officials might be targeted to gather sensitive geopolitical intel. Business executives could be targeted for economic espionage or by state-linked actors seeking leverage or insider information – the Lookout report noted Pegasus and similar tools have been used to spy on business executives and academics too.

Finally, it must be noted that ordinary citizens not fitting any of these categories are generally not targeted in large numbers by tools like Pegasus – these sophisticated (and expensive) spyware licenses are usually reserved for high-value targets. However, ordinary people may be swept up indirectly (for instance, if a journalist’s phone is infected, all their contacts’ communications are compromised; or if a spouse or family member of a dissident is targeted, it drags in others’ data). The why behind the targeting almost always comes down to power: governments deploy spyware to secure their political power, anticipate challenges, suppress dissent, or gain strategic advantages. Unlike mass surveillance programs that collect bulk data, tools like Pegasus are precision-guided weapons, used when a regime or agency has specific individuals it wants to watch closely – often in secret and without any legal oversight.

Ethical and Legal Controversies

The proliferation of government spyware has spurred a host of ethical, legal, and policy controversies. On an ethical level, these tools pose a dire threat to privacy, freedom of expression, and even personal safety. When an authoritarian regime can listen in on journalists and dissidents at will, the chilling effect on free speech and activism is enormous. Spyware has been linked to real-world harms – people have been arrested, intimidated, and even killed after their communications were intercepted. This raises profound human rights issues. Surveillance is typically subject to legal constraints and oversight in democratic societies (such as requiring court warrants), but spyware allows surveillance to run rampant with zero accountability. Victims usually never even know they were being watched until researchers find traces on their phone.

Legally, the use of Pegasus and similar tools has prompted lawsuits and diplomatic disputes. Tech companies are fighting back: WhatsApp sued NSO Group in 2019 after Pegasus was used to hack some 1,400 WhatsApp users via a vulnerability in the app. Apple followed with its own lawsuit in 2021, not only seeking to ban NSO from using Apple services but also announcing it would notify users it believes have been targeted. These lawsuits have had some success; in early 2023, the U.S. Supreme Court allowed WhatsApp’s case against NSO to move forward, rejecting NSO’s claim of immunity as a supplier to governments. Meanwhile, NSO and its peers have faced increasing restrictions. The U.S. Commerce Department’s blacklist (Entity List) for NSO means American companies cannot supply technology to NSO, cutting it off from critical software and support. There have also been calls in the EU to regulate or ban these spyware exports, especially after scandals in Hungary, Poland, Spain, and Greece revealed EU domestic use.

From an international standpoint, government spyware has at times created diplomatic rifts – for example, reports that Morocco’s government might have targeted French President Macron with Pegasus strained relations and led to high-level discussions about spyware abuse. Israel, which regulates NSO Group’s exports as a defense item, faced pressure and had to weigh national security concerns against the international blowback of being seen to enable authoritarian surveillance.

The core controversy boils down to this: Do the supposed security benefits of these tools outweigh the damage they do to civil liberties and trust in technology? Many human rights organizations strongly say “no.” They argue that until strict safeguards are in place, a moratorium on spyware is needed. As Human Rights Watch urged after discovering Pegasus on their staffer’s phone, governments should suspend the trade in surveillance technology until proper human rights protections are established. UN experts and privacy advocates similarly have called for a pause or ban on such spyware, given the mounting evidence of abuse. Even some democratic governments are rethinking their use; for instance, the U.S. government in 2023 announced it would limit federal agencies from using commercial spyware that have been misused by foreign governments, signaling concern over its unregulated spread.

On the flip side, law enforcement and intelligence agencies caution that sophisticated criminals and terrorists do use encrypted phones and apps, and that advanced spyware might be one of the few ways to lawfully intercept those communications. This argument, however, increasingly falters in the face of repeated scandals showing spyware aimed not at dangerous criminals, but at activists and political opponents. The debate now is less about whether abuses occur and more about how to stop them. As one security researcher put it, the spyware industry operates in “little or no transparency”, enabling a proliferation of dangerous hacking tools without public oversight. This secrecy and lack of accountability is at the heart of the ethical quandary.

Practical Tips: How to Protect Yourself

For the average person, the idea of defending against “government-grade” spyware can be daunting. It’s true that if a top-tier spyware specifically targets you, completely preventing an intrusion can be very difficult – especially in the case of zero-click exploits. However, there are practical steps that significantly improve your security and reduce the risk of spyware infection:

Keep Your Device Updated: Always install the latest software updates on your phone (both the operating system and apps). Spyware often exploits known vulnerabilities that vendors have already patched in newer updates. By running an outdated OS, you’re leaving the door open to exploits that could have been prevented. Enable automatic updates if possible, and periodically check that your device firmware is current.
Enable Extra Security (Lockdown Mode): If you believe you could be a higher-risk target (e.g., a journalist, activist, lawyer, or diplomat handling sensitive information), consider using any enhanced security modes your device offers. Apple, for instance, introduced “Lockdown Mode” in iOS 16 for people facing “grave, targeted threats” like Pegasus. When turned on, Lockdown Mode sharply restricts features that spyware campaigns have abused – it blocks most message attachments and link previews, disables incoming FaceTime calls from unknown people, and limits other avenues of attack. It essentially trades off some convenience for much stronger protection. Early indications are that Lockdown Mode would have thwarted certain Pegasus attacks by closing those avenues. If you have an iPhone and have any reason to suspect you might be targeted, using Lockdown Mode (even occasionally, during sensitive periods) is a wise precaution. On Android, an exact equivalent doesn’t exist, but you can manually tighten security by disabling services you don’t use (like rarely-used messaging apps, Bluetooth or FaceTime equivalents, etc.) and avoiding third-party app sources.
Beware of Suspicious Links and Messages: Remain vigilant about unexpected messages, even those that purport to be from known contacts. If you receive an SMS or email urging you to click a link – especially if it’s enticing or alarming – think twice. Spyware operators often craft messages on topics that could hook you (e.g., a breaking news link, a bank alert, or a personal note appearing to come from a friend). If something seems even slightly off or too coincidental, do not click the link. Verify through other means if possible. This simple habit can thwart many conventional phishing-based spyware attacks. As a rule, only open links or attachments from senders you completely trust, and even then be cautious if the message content is unusual.
Install Apps Only from Official Stores: Avoid installing applications from outside the official app stores (Apple App Store or Google Play Store). Both Apple and Google have vetting processes that catch most malware-laden apps. Spyware like Hermit relies on tricking users into sideloading apps or using enterprise certificates. By sticking to official channels, you eliminate many of those risks. On Android, if you’re prompted to allow installs from “unknown sources,” that’s a red flag unless you intentionally know what you’re doing. On iOS, do not trust random configuration profiles or certificates. In short, don’t sideload apps or click “Install” on apps that someone randomly asks you to install.
Use Strong Device Security Settings: Enable a strong passcode or biometric lock on your phone, and do not share it. This won’t stop a remote spyware hack, but it can protect against physical access attacks or someone trying to manually install spyware on your phone. Also, turn on features like Find My Phone and remote wipe, so you can erase your device if it’s lost or stolen (denying an attacker a chance to implant malware during that time). On Android, consider using Google Play Protect (which is on by default for most devices) as it can warn if known spyware signatures are detected.
Be Cautious with Public Networks and Chargers: Avoid connecting to strange Wi-Fi networks or public charging stations (USB chargers at airports, etc.), as these can theoretically be used to deliver exploits. Use a VPN on untrusted networks if possible. And if you’re in a high-risk job, you might even consider using a USB data blocker (a simple device that allows charging but not data transfer) when plugging into public chargers, to prevent any hidden data exchange.
Monitor Your Device for Unusual Behavior: While Pegasus-like spyware is designed to be stealthy, sometimes there are subtle signs of compromise – excessive battery drain, device overheating, unexpected crashes, or strange messages that flash and disappear. None of these alone confirm anything (they could be normal phone glitches), but if you notice a pattern of odd behavior, especially after clicking something suspicious, take it seriously. You could run a reputable mobile security app to scan for known threats (recognizing that new spyware may not be immediately identified). If you’re highly concerned, organizations like Amnesty International’s Security Lab and Citizen Lab have published tools (e.g. the Mobile Verification Toolkit) that technicians can use to check for traces of Pegasus on a phone. It’s technical, but security professionals or tech-savvy individuals might seek those resources if needed.
Practice Good Op-Sec: Operational security is about minimizing the damage in case you do get hacked. For instance, use end-to-end encrypted messaging apps for sensitive chats (Signal, WhatsApp, etc.) – though advanced spyware can grab messages after they’re decrypted, these apps still protect you against other threats and make broad interception harder. Avoid saying anything over the phone or in text that you absolutely wouldn’t want leaked, if possible use face-to-face for the most sensitive talks. Don’t store a long archive of personal data on your phone – regularly back up and remove old messages/media that could be compromising. The less data available on your device, the less a spyware operator can harvest. Some experts even suggest periodically rebooting your phone daily; some spyware (especially older versions) did not survive reboots and would have to reinfect, which might disrupt continuous surveillance. While rebooting isn’t a cure-all (some spyware now persists), it’s a harmless practice that could shake off certain attackers and at least clears out memory.

It’s important to stress that determined, well-funded adversaries may still find ways in, but these steps raise the bar significantly. Think of it like home security: a skilled burglar might bypass your locks, but you still lock your doors because it dissuades most intruders and may buy you time or evidence. By practicing good mobile security hygiene, you reduce your profile as an easy target.

Conclusion: Staying Informed and Vigilant

The emergence of government spyware like Pegasus, Predator, and Hermit represents a new frontier of digital espionage – one that poses grave challenges to privacy, press freedom, and democracy. These tools are potent and invasive, but what makes them truly dangerous is how they’ve been misused in the shadows, away from public scrutiny. As we’ve seen, no one is completely immune: from renowned journalists and activists to politicians and business leaders, spyware has been turned against a broad swath of society. The ethical and legal reckoning is only beginning. Stronger oversight, international regulations, and corporate responsibility are all urgently needed to prevent the further spread of “mercenary spyware” that is sold to the highest bidder.

For the average citizen, the idea of facing such an invisible threat can be unsettling. Yet, awareness is a powerful first line of defense. Understanding what these spyware tools are and how they operate helps us all be more cautious about our device use. It also builds public pressure on governments and companies to address the problem. The importance of awareness cannot be overstated – many victims had no idea their phones were being monitored until experts uncovered it. By staying informed about threats like Pegasus, questioning suspicious messages, and using the security tools at our disposal, we make it just a bit harder for authoritarian surveillance to succeed.

In a world where our smartphones are central to our lives, the notion that they could be turned against us is indeed scary. But rather than giving in to fear, we should respond with knowledge and vigilance. Journalists, researchers, and human rights groups are shining a light on spyware abuses, and that spotlight is forcing change – from courtrooms to corporate boardrooms. In the meantime, taking practical precautions in our own digital lives is wise. We lock our doors at night; now we must learn to lock down our digital devices too.

Ultimately, government spyware thrives on secrecy and indifference. By dragging it into the light and insisting on accountability, we can curtail its abuses. The battle between surveillance technology and privacy will likely rage on, but an informed public is far less vulnerable. Staying one step ahead of spyware starts with understanding it – and refusing to be silent about the threat it poses. The more people know about Pegasus and its ilk, the fewer places those tools will have to hide.

Sources: Citizen Lab; The Guardian; Amnesty International; Wired; Lookout Security; Google Threat Analysis Group; Wikipedia; Forbidden Stories; Human Rights Watch.