NSO Group

A cross-border investigation by Forbidden Stories, the Guardian and Middle East Eye, based on a decade-long DGST insider (pseudonym 'Safir') corroborated by security sources in Morocco and Europe, detailed how Morocco's intelligence agency DGST acquired and used NSO Group's Pegasus spyware from 2017 onward against domestic political opponents, journalists and foreign officials, including French President Emmanuel Macron and 15 French government members. The investigation described a three-party arrangement in which a UAE-linked company (Al Fahad Smart Systems, later acquired by UAE state-owned defense group Edge) acted as financial intermediary or payer for Morocco's access to Pegasus. Morocco has consistently denied purchasing Pegasus despite the documentary and testimonial evidence; NSO Group declined to confirm Morocco as a customer, citing Israeli law.

Middle East Eye reported in June 2026 that Israeli spyware firm NSO Group continued to target WhatsApp users with Pegasus despite a binding US court order arising from the Meta v. NSO Group litigation. The reporting cited evidence of continued infections after the judgment, raising the prospect of contempt proceedings and renewed pressure on US sanctions enforcement against the company.

In November 2025, NSO Group named David Friedman, Trump's former ambassador to Israel, as Executive Chairman. This followed an October 2025 acquisition by U.S.-based investors led by film producer Robert Simonds. The appointment raises concerns about NSO's potential re-entry into U.S. markets after being placed on the Entity List.

In the Meta/WhatsApp lawsuit against NSO Group, a U.S. federal court found NSO liable for violating the Computer Fraud and Abuse Act by accessing WhatsApp servers to install Pegasus spyware on over 1,400 devices in 2019. In May 2025, the court ordered NSO to pay $167 million in damages. During the lawsuit proceedings, court documents revealed Saudi Arabia as one of NSO's Pegasus customers. Evidence showed the spyware was used against Princess Haya of Dubai and associates of murdered journalist Jamal Khashoggi. NSO admitted it had cut off 10 government customers for abusing Pegasus.

Citizen Lab forensic analysis published July 2, 2026 found with high confidence that former Greek MEP Stelios Kouloglou's phone was infected with NSO Group's Pegasus spyware on October 21, 2022 and again on March 6-7, 2023, while he served on the European Parliament's PEGA committee investigating spyware abuses. Citizen Lab did not attribute the operation to a specific government, but linked the operator to infrastructure previously used in a campaign targeting Russian- and Belarusian-speaking journalists and activists across Europe, and found no evidence Greece was the customer.

In March 2022, the European Parliament established the PEGA committee to investigate abuses of Pegasus spyware by European member states. The committee found that at least 22 customers in 14 EU member states had purchased Pegasus. During testimony, NSO admitted it only investigates misuse when it receives information from whistleblowers or media. In June 2023, the Parliament adopted a resolution calling for boundaries on law enforcement use of spyware. Despite calls from 86+ human rights organizations, the EU has not imposed direct sanctions on NSO Group.

In January 2022, Citizen Lab and Access Now revealed that 22 employees of El Faro, a prominent Salvadoran independent news outlet, had their phones infiltrated with Pegasus between July 2020 and November 2021. The investigation found that journalists from 13 other Salvadoran news organizations were also targeted. El Faro is known for its investigative reporting on government corruption and gang negotiations in El Salvador.

In November 2021, Apple notified Human Rights Watch researcher Lama Fakih that state-sponsored attackers were targeting her iPhone. The HRW information security team and Amnesty International's Security Lab confirmed her devices had been infected with Pegasus spyware. This demonstrated that NSO's government clients used the spyware against staff of major international human rights organizations, not just individual activists and journalists.

On November 23, 2021, Apple announced a lawsuit against NSO Group and its parent company OSY Technologies for surveilling and targeting iPhone users with Pegasus spyware. Apple sought a permanent injunction banning NSO from using any Apple software, services, or devices, and pledged $10 million plus any damages to organizations pursuing cybersurveillance research. In September 2024, Apple dropped the lawsuit citing concerns that critical spyware files might never be disclosed and that Apple's own disclosures could aid NSO.

In November 2021, the U.S. Department of Commerce added NSO Group to its Entity List, an export control regime aimed at preventing proliferation of dangerous weapons. The action cited NSO's role in enabling foreign governments to conduct transnational repression, targeting journalists, activists, and dissidents with Pegasus spyware.

In July 2021, a consortium of 17 media organizations led by Forbidden Stories and Amnesty International published the Pegasus Project, revealing a leaked list of 50,000+ phone numbers believed to have been identified as persons of interest by NSO Group clients since 2016. Targets included at least 189 journalists, 85 human rights activists, 65 business executives, and 600+ politicians and government officials across more than 50 countries. NSO clients were identified in 11 countries including Azerbaijan, Bahrain, Hungary, India, Kazakhstan, Mexico, Morocco, Rwanda, Saudi Arabia, Togo, and the UAE.

In April 2019, NSO Group froze its deals with Saudi Arabia over allegations that NSO software played a role in tracking murdered journalist Jamal Khashoggi in the months before his death. This represented a rare instance of NSO taking action against a client government for potential misuse of its spyware technology. However, reports suggest the suspension was temporary and that Saudi Arabia remained a client.

Amnesty International's Security Lab established that Pegasus spyware was successfully installed on the phone of Jamal Khashoggi's fiancee Hatice Cengiz just four days after his murder by Saudi operatives in October 2018. His wife Hanan Elatr was also repeatedly targeted between September 2017 and April 2018, and his son Abdullah was selected as a target. NSO denied association with Khashoggi's murder but the evidence showed its Saudi client used Pegasus to surveil the journalist's inner circle.

The Pegasus Project investigation revealed that at least 25 Mexican journalists were selected for targeting with Pegasus spyware over a two-year period. Among them was journalist Cecilio Pineda, whose phone was selected for targeting just weeks before he was killed in March 2017. Mexico was one of the earliest and most prolific users of Pegasus, with documented targeting of journalists, activists, and political opponents by Mexican authorities.