Pegasus is spyware built by NSO Group, an Israeli company that sells surveillance tools to government agencies. It runs on iPhones and Android devices, and its defining feature is simple: it can install without the owner tapping anything. No app to approve, no link to open, no permission prompt to dismiss. That single design choice explains why Pegasus keeps turning up on the phones of journalists, lawyers and political figures — and why "just be careful what you click" is not an answer.

Here is how the infection actually happens, why a fully patched phone remains a viable target, and what you can realistically check.

What Pegasus Is — and What It Is Not

Pegasus is commercial spyware, not an outbreak. NSO has said it sells only to vetted government clients for fighting serious crime and terrorism, and the company has disputed some findings about how its tools were used. Researchers at Citizen Lab and Amnesty International's Security Lab have documented infections among civil society targets. Both things can be true at once: a tool marketed for one purpose can be pointed at another.

It does not spread by itself. It doesn't jump from phone to phone, doesn't ride along in an email attachment to your whole contact list. Targets are selected. If Pegasus is on a phone, someone decided to put it there.

What it delivers is the phone and its surroundings: messages read after decryption, microphone and camera access, location, call logs, contacts, photos. Pegasus is also not the only tool of its kind — Predator, Graphite and Reign belong to the same class, which is why the advice below generalises.

How the Infection Actually Works

Zero-click: nothing for you to do

A zero-click exploit turns a normal feature into a delivery mechanism. Your phone has to receive data, and receiving data means parsing it. A flaw in that parser can be converted into code execution. Documented examples include:

• iMessage. In 2021, a message containing an image the phone handled as an animated GIF could compromise an iPhone with no interaction at all. Citizen Lab reported it, Google's Project Zero analysed it, and Apple patched it in iOS 14.8. The message often left no visible trace.
• WhatsApp voice calls. A 2019 flaw (CVE-2019-3568) let a crafted call reach the phone whether or not you answered. WhatsApp fixed it quickly, but the pattern has repeated since.
• Other routes. SMS and MMS, calendar invitations, push notifications, and interception at the network level over Wi-Fi or carrier infrastructure.

Entry is only step one. The process that parses your messages isn't allowed to read your mail, so an exploit chain escalates privileges until it reaches the kernel — the core of the operating system. Kernel access is a different game entirely: it can bypass app sandboxing, hide files and processes from the system, and keep the implant running.

One-click still works too

Operators don't burn a zero-day when something cheaper will do. A link dressed up as a news story, a courier notification or a shared document is far less expensive, and it succeeds often enough. So the old habit still matters — don't open links from unknown senders. It removes a large chunk of risk, even if it isn't a complete defence.

Why an Updated Phone Can Still Be Targeted

• Zero-days work against patched software. That is the definition: nobody knows about the flaw, so no fix exists yet.
• Nothing depends on your behaviour. No mistake is required. The attack can happen while the phone sits locked in your pocket.
• Patch lag. A flaw is found, reported, fixed, released, installed. That chain takes weeks or months — and sometimes the vendor never learns at all.
• Software is layered. The operating system, the browser, the messaging apps and the baseband firmware all get patched separately. Closing one door doesn't close the next.
• The tool is modular. When a patch shuts down one exploit chain, operators can swap in another.
• Demand doesn't disappear. In some countries such surveillance is authorised by a warrant, so buyers keep buying regardless of patch cycles.

Updates are still worth installing. They close every known door. They just can't close the unknown one.

Signs to Watch For

An infected phone can look completely normal, and every symptom below has innocent explanations — an ageing battery, a bad app update, weak signal. Look for a cluster appearing around the same time, not a single item.

• Battery draining noticeably faster, especially when the phone is idle.
• The device feeling warm while you're not using it.
• Background data use jumping, sometimes in odd bursts at night.
• Unexplained reboots, apps crashing, sudden sluggishness.
• Strange SMS with random characters, or link previews to content you don't recognise.
• Missed calls from numbers that never call back.
• A configuration profile or device-admin app you never installed.
• Accounts logging themselves out.

How to Check a Phone

1. Inspect profiles and device admins. On iOS: Settings > General > VPN & Device Management. On Android: Settings > Security > Device admin apps. Note the name of anything you can't explain before removing it.
2. Run a forensic scan. Amnesty International's Security Lab publishes MVT (Mobile Verification Toolkit), which is free and open source. It runs on a computer against a backup or full file system dump and looks for known Pegasus indicators. A clean result is not proof of a clean phone, because indicators change.
3. Get expert help if you're plausibly a target — a journalist, activist, lawyer or party to contentious litigation. Access Now runs a free, confidential digital security helpline, and university and NGO labs take on cases.
4. Do not factory reset before you get advice. Wiping the phone destroys the evidence that would confirm or rule out an infection.
5. Isolate the device. Leave it out of sensitive meetings and move important conversations to a freshly set-up phone.

Practical Steps That Help

Turn on Lockdown Mode on iPhone (iOS 16 and later) or Android's Advanced Protection. Both cut off the message parsers, link previews and unsolicited invitations that zero-click attacks lean on. Some features break; that is the trade you are making deliberately.

Keep everything updated and let the phone install updates overnight. Reboot it daily — some Pegasus versions on iOS were not persistent, so a restart can clear an implant, though operators can reinfect. Cut iMessage and FaceTime if you don't need them. Avoid random Wi-Fi networks. Keep genuinely sensitive documents off the phone you carry around.

And if there's a legal dimension — a court case, a dispute, a protection order — speak to a lawyer or a digital rights organisation in your country. Surveillance law varies enormously between jurisdictions, and nothing here is legal advice. If you have reason to believe you are being targeted, the right move is to get specialists involved early, not to try cleaning the phone yourself.

Photo: RDNE Stock project / Pexels