NSO Group Pegasus: The 2021 Pegasus Project Disclosures
In July 2021, the Pegasus Project—a consortium led by Forbidden Stories with Amnesty International's Security Lab and sixteen media partners—published forensic evidence that NSO Group's Pegasus spyware had infected or targeted the phones of journalists, human rights defenders, politicians, and heads of state across multiple countries. Independent forensic verification by Citizen Lab corroborated Amnesty's methodology and findings on a subset of examined devices, confirming the presence of Pegasus infection artifacts. The disclosures were based on analysis of a leaked list of over 50,000 phone numbers and forensic examination of dozens of devices, establishing one of the most extensively documented commercial spyware cases to date.
Forensic analysis by Amnesty International's Security Lab, independently peer-reviewed by Citizen Lab, confirmed Pegasus spyware infections on numerous devices belonging to journalists, activists, and political figures identified in a leaked targeting list.
How we know
Each source is linked so the finding can be checked independently. The archive's analysis below interprets these sources; it does not replace them.
Massive Data Leak Reveals Israeli NSO Group's Spyware Used to Target Activists, Journalists, and Political Leaders Globally
News report· Forbidden Stories· 2021-07-18Open primary sourceForensic Methodology Report: How to Catch NSO Group's Pegasus
Forensic lab finding· Amnesty International Security Lab· 2021-07-18Open primary sourceNSO Group Spyware Used to Target Journalists and Activists Worldwide, Investigation Finds
News report· The Washington Post· 2021-07-18Open primary sourceIndependent Peer Review of Amnesty International's Forensic Methodology
Forensic lab finding· Citizen Lab· 2021-07-18Open primary source
Spyphone Research Archive analysis
The section below is this archive's own interpretation of the sources above. It is not a primary document and is not attributed to any court, laboratory, or vendor.
The Pegasus Project represents a watershed moment in the public documentation of commercial spyware abuse, not because it was the first forensic confirmation of Pegasus infections—Citizen Lab had been publishing such findings since 2016—but because of the scale, coordination, and journalistic rigor brought to bear on a single disclosure event. Our archive views the methodological pairing of Amnesty's Mobile Verification Toolkit (MVT) analysis with Citizen Lab's independent peer review as the critical factor elevating this case from 'alleged' to 'verified' status. The existence of a leaked numbers list alone would have remained speculative; it was the device-level forensic traces—process names, network indicators of compromise, and installation artifacts consistent with known Pegasus infrastructure—that transformed allegation into documented fact.
What distinguishes this case within the broader spyware accountability landscape is the deliberate separation of the targeting list (which indicated selection, not necessarily successful infection) from the forensic confirmation set (which proved actual compromise). Critics and NSO Group itself attempted to conflate these two categories to cast doubt on the entire investigation, a tactic this archive consistently finds employed by spyware vendors facing forensic scrutiny: disputing the significance of a leaked list while declining to substantively rebut the independently verified forensic artifacts. The fact that Citizen Lab, operating independently and with its own methodology, corroborated infections on phones also examined by Amnesty substantially undercuts any claim that the findings were the product of a single biased actor or flawed toolset.
In our assessment, the lasting significance of the 2021 disclosures lies less in any single confirmed infection and more in the demonstration effect: it established a replicable forensic and journalistic model—cross-lab verification, device imaging, and coordinated multi-outlet publication—that has since become the baseline standard for credible spyware accountability reporting. Subsequent cases involving Pegasus and other mercenary spyware products have been evaluated by this archive against the evidentiary bar set here, and we note that few disclosures since have matched the combination of leaked targeting data, multi-device forensic confirmation, and independent cross-laboratory corroboration achieved in this instance.
Attribution
This record was compiled and edited by the Spyphone Research Archive Editorial Team. Forensic device analysis and methodology are attributed to Amnesty International's Security Lab, with independent peer review and corroborating forensic findings attributed to the Citizen Lab at the University of Toronto's Munk School.
Correction history
- 2026-10-19
Record first published.