London Daily

Focus on the big picture.
Thursday, Oct 23, 2025

How to Search for, Spot and Stamp Out Pegasus Spyware From Your Phone

How to Search for, Spot and Stamp Out Pegasus Spyware From Your Phone

The powerful Israeli military-grade spyware made international headlines on Sunday, when media investigations discovered that at least 50,000 people across more than a dozen nations had their cellphones targeted in sophisticated hack attacks that stole information and turned devices into mobile bugs.

Governments, journalists, opposition politicians and rights groups worldwide are demanding a formal inquiry into Pegasus, the spyware product created by shadowy Israeli software company NSO Group. Sold to states to ‘fight terrorism and crime’, the software has been discovered to have been used in unscrupulous ways to target members of the press, lawmakers and others, helping to stamp out dissent or allow governments to get ahead of potentially embarrassing scandals.

How It Works


Pegasus is not your typical one-click piece of malware which requires user interaction – usually by following on a malicious link - to get access to a device. Instead, the spyware infects phones through a so-called zero-click attack, which needs no interaction from the user and simply installs itself and starts harvesting data.

Once installed, the spyware, which is compatible with both Android and Apple iOS, can gain access to all manner of data on a user’s phone, from contacts and encrypted messages to call records, photos, and GPS location data. What’s more, it’s capable of turning microphones and cameras on or off remotely, thus turning the user’s device into a mobile listening or viewing device.

To conceal its presence, Pegasus minimises bandwidth consumption to avoid draining the battery and raising user suspicions. Instead, it sends regular scheduled updates to command and control servers (C2s) – the computers or domains used by whoever is doing the spying. Unfortunately, the spyware is also impervious to commercially available antivirus software.

How to Check for Pegasus?


The spyware’s inconspicuous nature, its zero-click installation, and imperviousness to antiviruses makes it virtually impossible for phone owners to detect its presence simply by observing their device.

There’s hope, however. Because the software connects to the aforementioned C2s, a search to determine whether or not a phone communicated with known Pegasus installation servers can theoretically detect whether the malware is present.

Amnesty International, the London-based human rights organisation that helped media blow the lid off the extent of Pegasus’ spread in this weekend’s reporting, identified compromised iPhone devices by studying the records of process executions and network usage performed the phones’ database files - datausage.sqlite and netusage.sqlite.

Amnesty’s analysis found a total of 45 suspicious process names in their analysis, with Citizen Lab, a University of Toronto-based software developer working to protect citizens against surveillance, matching 28 of these processes in their own independently conducted inquiry.

Technology giants such as Apple, and app-makers such as Facebook’s WhatsApp, haven't simply been sitting on their hands while Pegasus runs amok on their devices and software since the spyware was first discovered in 2016, and have sought to close security breaches once they are found. This is one reason NSO Group has worked to develop new versions of its spyware. Unfortunately, the Israeli spyware giant appears to have remained one step ahead of companies such as Apple for the moment, with Citizen Lab research fellow Bill Marczak reporting on Monday that the latest version of iOS, version 14.6, is still vulnerable to Pegasus’ zero-click attacks.


Users can independently scan their phones for signs that their device has been compromised using Amnesty’s ‘indicator of compromise’ (IoC) toolkit. The software, formally known as the ‘Mobile Verification Toolkit’ or MVT, works with both iOS and Android, and is available for download here.

In its current form, the software is not an easy-to-use experience, has no graphical user interface, and installs on phones’ command line, meaning that basic knowledge of basic coding is needed (details here). The toolkit also requires the download and installation of dependencies to operate.

Once installed, the software allows users to create a backup of their device, check backup files, including artefacts from iTunes’ proprietary backup system, if applicable, extract artefacts from filesystem dumps, and compare stored data with known indicators of compromise. The Android version of the software, which Amnesty says is less fleshed out because of Pegasus’ greater prevalence on iOS devices, includes the ability to check for the download of non-safelisted APKs (apps), and to search for backups for text messages with links to the roughly 700 known NSO domains (Amnesty says this list will be continually updated).

TechCrunch contributor Zack Whittaker tested out the toolkit on an iPhone, and reported that it takes about 10 minutes to get it up and running, plus the time it takes to back up the phone, which is necessary to decrypt locally stored files. The scan itself takes just one to two minutes, and lists possible signs of compromise in the outputted files.

You’ve Got Pegasus – What Now?


Tech experts don’t make it explicitly clear what can be done if Pegasus is found on a device. In a 2019 study, Citizen Lab found that in the case of Android devices, the malware can survive a factory reset on some phones, meaning that the only way to be sure you’re not infected is to get a new phone.

It’s not clear whether NSO Group’s software can survive a hard reset on iOS devices, with Apple tech support reluctant even to admit that its advanced “sandboxed iOS architecture” can be compromised, and recommending software updates to deal with the problem (they don't).

Tech specialists don’t mention it, but another possible way to reduce exposure to Pegasus is to reduce one’s exposure to the digital world.

Journalists, activists, politicians and others who feel vulnerable can do so by using landlines or simple button phones with no internet capabilities for Pegasus to exploit, by engaging in face-to-face meetings instead of voice and text message conversations, using analogue or simple digital voice recorders, etc. If giving up your smartphone is not an option, there’s always the alternative of using a non-Android, non-iOS smartphone, which may be less vulnerable to the Israeli spyware by virtue of its more limited user base.

None of these techniques can guarantee that whoever may be monitoring you illegally won’t be able to do so, but it will at least require a greater effort on their behalf to do so.

Newsletter

Related Articles

0:00
0:00
Close
Porsche Reverses EV Strategy as New CEO Bets on Petrol and Hybrids
Singapore’s Prime Minister Warns of ‘Messy’ Transition to Post-American Global Order
Andreessen Horowitz Sets Sights on Ten-Billion-Dollar Fund for Tech Surge
US Administration Under President Donald Trump Reportedly Lifts Ban on Ukraine’s Use of Storm Shadow Missiles Against Russia
‘Frightening’ First Night in Prison for Sarkozy: Inmates Riot and Shout ‘Little Nicolas’
White House Announces No Imminent Summit Between Trump and Putin
US and Qatar Warn EU of Trade and Energy Risks from Tough Climate Regulation
Apple Challenges EU Digital Markets Act Crackdown in Landmark Court Battle
Nicolas Sarkozy begins five-year prison term at La Santé in Paris
Japan stocks surge to record as Sanae Takaichi becomes Prime Minister
This Is How the 'Heist of the Century' Was Carried Out at the Louvre in Seven Minutes: France Humiliated as Crown with 2,000 Diamonds Vanishes
China Warns UK of ‘Consequences’ After Delay to London Embassy Approval
France’s Wealthy Shift Billions to Luxembourg and Switzerland Amid Tax and Political Turmoil
"Sniper Position": Observation Post Targeting 'Air Force One' Found Before Trump’s Arrival in Florida
Shouting Match at the White House: 'Trump Cursed, Threw Maps, and Told Zelensky – "Putin Will Destroy You"'
Windows’ Own ‘Siri’ Has Arrived: You Can Now Talk to Your Computer
Thailand and Singapore Investigate Cambodian-Based Prince Group as U.S. and U.K. Sanctions Unfold
‘No Kings’ Protests Inflate Numbers — But History Shows Nations Collapse Without Strong Executive Power
Chinese Tech Giants Halt Stablecoin Launches After Beijing’s Regulatory Intervention
Manhattan Jury Holds BNP Paribas Liable for Enabling Sudanese Government Abuses
Trump Orders Immediate Release of Former Congressman George Santos After Commuting Prison Sentence
S&P Downgrades France’s Credit Rating, Citing Soaring Debt and Political Instability
Ofcom Rules BBC’s Gaza Documentary ‘Materially Misleading’ Over Narrator’s Hamas Ties
Diane Keaton’s Cause of Death Revealed as Pneumonia, Family Confirms
Former Lostprophets Frontman Ian Watkins Stabbed to Death in British Prison
"The Tsunami Is Coming, and It’s Massive": The World’s Richest Man Unveils a New AI Vision
Outsider, Heroine, Trailblazer: Diane Keaton Was Always a Little Strange — and Forever One of a Kind
Dramatic Development in the Death of 'Mango' Founder: Billionaire's Son Suspected of Murder
Two Years of Darkness: The Harrowing Testimonies of Israeli Hostages Emerging From Gaza Captivity
EU Moves to Use Frozen Russian Assets to Buy U.S. Weapons for Ukraine
Europe Emerges as the Biggest Casualty in U.S.-China Rare Earth Rivalry
HSBC Confronts Strategic Crossroads as NAB Seeks Only Retail Arm in Australia Exit
U.S. Chamber Sues Trump Over $100,000 H-1B Visa Fee
Shenzhen Expo Spotlights China’s Quantum Step in Semiconductor Self-Reliance
China Accelerates to the Forefront in Global Nuclear Fusion Race
Yachts, Private Jets, and a Picasso Painting: Exposed as 'One of the Largest Frauds in History'
Australia’s Wedgetail Spies Aid NATO Response as Russian MiGs Breach Estonian Airspace
McGowan Urges Chalmers to Cut Spending Over Tax Hike to Close $20 Billion Budget Gap
Victoria Orders Review of Transgender Prison Placement Amid Safety Concerns for Female Inmates
U.S. Treasury Mobilises New $20 Billion Debt Facility to Stabilise Argentina
French Business Leaders Decry Budget as Macron’s Pro-Enterprise Promise Undermined
Trump Claims Modi Pledged India Would End Russian Oil Imports Amid U.S. Tariff Pressure
Surging AI Startup Valuations Fuel Bubble Concerns Among Top Investors
Australian Punter Archie Wilson Tears Up During Nebraska Press Conference, Sparking Conversation on Male Vulnerability
Australia Confirms U.S. Access to Upgraded Submarine Shipyard Under AUKUS Deal
“Firepower” Promised for Ukraine as NATO Ministers Meet — But U.S. Tomahawks Remain Undecided
Brands Confront New Dilemma as Extremists Adopt Fashion Labels
The Sydney Sweeney and Jeans Storm: “The Outcome Surpassed Our Wildest Dreams”
Erika Kirk Delivers Moving Tribute at White House as Trump Awards Charlie Presidential Medal of Freedom
British Food Influencer ‘Big John’ Detained in Australia After Visa Dispute
×