Despite NSO Group’s claims, spyware has continued to target journalists, dissidents and protesters. Saudi journalist and dissident Jamal Khashoggi’s wife Hanan Elatr was said to have been attacked with Pegasus before his death. In 2021, New York Times Reporter Ben Hubbard learned that his phone had been attacked twice with Pegasus.
Pegasus was quietly implanted on the iPhone of Claude Magnin, the wife of political activist Naama Asfari, who was imprisoned and allegedly tortured in Morocco. Pegasus has also been used to target pro-democracy protesters in Thailand, Russian journalist Galina Timchenko and British government officials.
In 2021, Apple filed a lawsuit against NSO Group and its parent company to hold them accountable for “surveilling and targeting Apple users.”
The case is ongoing and NSO Group is seeking to dismiss the lawsuit. However, experts believe that the problem will not go away as long as spyware providers are able to act.
David Ruiz, chief privacy officer at security firm Malwarebytes, blames “the obsessive and repressive operators behind spyware, who increase the threat to society.”
The spyware drain
If you’re faced with a zero-click exploit that distributes spyware, experts say there’s very little you can do to protect yourself or restore the security of your devices. “The best thing you can do if you are targeted is to completely abandon both the hardware and any accounts associated with it,” says Aaron Engel, chief information security officer at ExpressVPN. “Get a new computer, a new phone number, and create entirely new accounts linked to the device.”
Detecting spyware can be challenging, but unusual behavior such as rapid battery drain, unexpected shutdowns, or high data usage could indicate an infection, says Javvad Malik, lead security awareness advocate at security training organization KnowBe4. While certain apps claim to detect spyware, their effectiveness can vary and reliable detection often requires professional help, he says.
Chris Hauk, consumer protection advocate at Pixel Privacy, agrees that battery drain is a strong indicator of spyware on your device. “Most spyware is not designed to run efficiently,” he says.
Users should also be aware of uninstalled apps, forced redirects due to browser hijacking, and changed settings in their default browser or search engine.
Earlier this year, Kaspersky’s team introduced a method for detecting infection indicators from iOS spyware such as Pegasus, Reign and Predator. This is effective because Pegasus infections leave traces in the unexpected system log Shutdown.log, which is stored in the Sysdiagnose archive of iOS devices, according to the security team.
Another step to protect your device is to make sure you restart it at least once a day. “This requires attackers to repeatedly reinfect, increasing the chances of detection over time,” says Larin.
If you might be a target, you can also turn off iMessage and FaceTime to reduce the risk of falling victim to zero-click attacks. At the same time, keep your device up to date with the latest software and avoid clicking on links that you receive in messages such as emails.
“Update to the latest software version to protect against known vulnerabilities, use multifactor authentication, and only install applications from verified and legitimate sources,” says Adam Price, cyber threat intelligence analyst at Cyjax.
If you fall victim, there are helplines available to assist you with spyware removal, such as Access Now’s Digital Security Helpline and Amnesty International’s Security Lab. Meanwhile, Apple’s Lock Mode – which disables certain features but is surprisingly useful – can protect your iPhone from infection.