A leaked list of more than 50,000 phone numbers has been tied to clients of Israeli spyware maker NSO Group, according to a joint investigation by The Washington Post, The Guardian, Le Monde and other outlets. The numbers belong to journalists, activists, business executives and politicians across more than 50 countries, and forensic checks on 37 of the phones confirmed successful intrusions. NSO called the report's claims false and threatened legal action.
The data lands in a debate that has been running since 2016, when researchers first accused NSO of helping to spy on a dissident in the United Arab Emirates. Pegasus turns a phone into a pocket spy by switching on its camera and microphone and pulling stored data. In some cases it installs without any tap from the user, which is exactly what makes it dangerous to ordinary readers as well as the named targets.
Who should care
| Profile | Why Pegasus matters |
|---|---|
| Journalists | Phone numbers of reporters at AFP, WSJ, CNN, NYT, Al Jazeera, El Pais, AP, Le Monde, Bloomberg, The Economist, Reuters appear on the list. Past reporting already documented targeting of Al Jazeera staff and Moroccan journalist Omar Radi. |
| Activists | At least 85 human rights activists are identified in the dataset, many in countries with documented restrictions on civil society. |
| Business executives | 65 executives appear on the list across countries including Mexico, Morocco and the UAE, where commercial disputes often overlap with state interests. |
| Politicians and officials | 600-plus numbers include heads of state, prime ministers and cabinet ministers, suggesting the tool has been used beyond criminal investigations. |
| General public | Pegasus demonstrates that state-grade spyware can infect phones without any action from the user. The same vulnerability chain that hits activists can hit anyone if a government decides to target them. |
How Pegasus actually works
Older phone spyware needed the target to click a dodgy link. Pegasus has moved past that. Once an operator has the target's number, several attack paths can deliver the payload, including so-called zero-click exploits that hit the phone through messaging apps or the operating system itself. Once in, the implant can pull messages, contacts, location, photos, and turn on the mic and camera on demand. The device looks and behaves like a normal phone the whole time.
That is a meaningful jump from run-of-the-mill phishing or smishing, where the victim at least has a chance to notice a strange URL. Pegasus hides the delivery stage. For readers who follow cybercrime news, this is the line worth tracking: state-grade spyware is creeping closer to the same invisibility that financially motivated malware has had for years.
A worked scenario
Say you are a freelance reporter covering business fraud in a region where local contractors are linked to foreign governments. You use a single phone for sources, drafts and email. To lower exposure, keep a separate, cheap handset for sources who need extra protection. Reboot the main phone daily; some zero-click chains do not survive a clean restart, and that small habit shrinks the window an implant has. Keep the OS patched the day a release lands, and split sensitive chats onto an end-to-end encrypted app that supports disappearing messages and independent device keys. None of this stops a determined state attacker, but it does push you out of the easy pool of targets.
Our analysis
The leak reframes a long-running argument. For years NSO has marketed Pegasus as a targeted tool sold only to vetted governments. The list, if the reporting holds up, suggests the targeting is broader and sloppier than the sales pitch claims. Governments named in the cluster, including India, have publicly denied using the malware on their own citizens. The investigative consortium has put the burden back on those governments, and on NSO, to explain why those numbers were on the list at all.
The second thread is export control. Israel licenses NSO's exports, and the European Parliament has already pushed for tighter rules on surveillance tools. A 50,000-number dataset gives regulators something concrete to point at. Watch for movement in Israel, the EU and the US Treasury, which has already blacklisted some NSO rivals.
The third thread is legal. NSO is threatening a defamation case. That fight will turn on whether the consortium can defend the sourcing in court. Either way, the publication itself is a form of defense: telling targets they were on a list lets them check their devices and build a record.
What to watch next
Expect more export fights, more diplomatic pressure on Israel, and more journalists and activists rotating devices and habits on their own. For the wider public, the practical move is the boring one: patched OS, daily reboot, encrypted apps, separate device for sensitive work. Bottom line: you are unlikely to be on this list, but you live in the same surveillance environment as the people who are, and the same hygiene helps everyone.
Key takeaways
- Pegasus turns a phone into a pocket spy without the user doing anything; assume a compromised phone looks normal.
- Past reporting by Citizen Lab and Amnesty already flagged Pegasus abuse against journalists and dissidents.
- Daily reboot, fast OS patches and device separation are the cheapest defensive moves for at-risk users.
- Watch Israeli export licensing and possible EU and US sanctions as the political fallout unfolds.
Frequently asked questions
Who is behind Pegasus spyware?
Pegasus is developed by NSO Group, an Israeli firm founded in 2010 and based near Tel Aviv, according to the reporting.
Can Pegasus hack any phone?
Pegasus targets specific phones chosen by the operator. Earlier versions required a link click, while newer exploits can install without any user interaction.
How do I know if my phone was targeted?
There is no public self-check tool for Pegasus. Forensic outfits like Citizen Lab and Amnesty's Security Lab have helped high-risk users audit devices after suspected targeting.
Did NSO admit to the allegations?
No. NSO called the report's claims false and said it sells only to vetted law enforcement and intelligence agencies.
Were any numbers linked to Khashoggi?
The Washington Post reported that two phones belonging to people close to Saudi journalist Jamal Khashoggi showed evidence of successful Pegasus intrusions.