London Daily

Focus on the big picture.
Monday, Sep 15, 2025

How to Search for, Spot and Stamp Out Pegasus Spyware From Your Phone

How to Search for, Spot and Stamp Out Pegasus Spyware From Your Phone

The powerful Israeli military-grade spyware made international headlines on Sunday, when media investigations discovered that at least 50,000 people across more than a dozen nations had their cellphones targeted in sophisticated hack attacks that stole information and turned devices into mobile bugs.

Governments, journalists, opposition politicians and rights groups worldwide are demanding a formal inquiry into Pegasus, the spyware product created by shadowy Israeli software company NSO Group. Sold to states to ‘fight terrorism and crime’, the software has been discovered to have been used in unscrupulous ways to target members of the press, lawmakers and others, helping to stamp out dissent or allow governments to get ahead of potentially embarrassing scandals.

How It Works


Pegasus is not your typical one-click piece of malware which requires user interaction – usually by following on a malicious link - to get access to a device. Instead, the spyware infects phones through a so-called zero-click attack, which needs no interaction from the user and simply installs itself and starts harvesting data.

Once installed, the spyware, which is compatible with both Android and Apple iOS, can gain access to all manner of data on a user’s phone, from contacts and encrypted messages to call records, photos, and GPS location data. What’s more, it’s capable of turning microphones and cameras on or off remotely, thus turning the user’s device into a mobile listening or viewing device.

To conceal its presence, Pegasus minimises bandwidth consumption to avoid draining the battery and raising user suspicions. Instead, it sends regular scheduled updates to command and control servers (C2s) – the computers or domains used by whoever is doing the spying. Unfortunately, the spyware is also impervious to commercially available antivirus software.

How to Check for Pegasus?


The spyware’s inconspicuous nature, its zero-click installation, and imperviousness to antiviruses makes it virtually impossible for phone owners to detect its presence simply by observing their device.

There’s hope, however. Because the software connects to the aforementioned C2s, a search to determine whether or not a phone communicated with known Pegasus installation servers can theoretically detect whether the malware is present.

Amnesty International, the London-based human rights organisation that helped media blow the lid off the extent of Pegasus’ spread in this weekend’s reporting, identified compromised iPhone devices by studying the records of process executions and network usage performed the phones’ database files - datausage.sqlite and netusage.sqlite.

Amnesty’s analysis found a total of 45 suspicious process names in their analysis, with Citizen Lab, a University of Toronto-based software developer working to protect citizens against surveillance, matching 28 of these processes in their own independently conducted inquiry.

Technology giants such as Apple, and app-makers such as Facebook’s WhatsApp, haven't simply been sitting on their hands while Pegasus runs amok on their devices and software since the spyware was first discovered in 2016, and have sought to close security breaches once they are found. This is one reason NSO Group has worked to develop new versions of its spyware. Unfortunately, the Israeli spyware giant appears to have remained one step ahead of companies such as Apple for the moment, with Citizen Lab research fellow Bill Marczak reporting on Monday that the latest version of iOS, version 14.6, is still vulnerable to Pegasus’ zero-click attacks.


Users can independently scan their phones for signs that their device has been compromised using Amnesty’s ‘indicator of compromise’ (IoC) toolkit. The software, formally known as the ‘Mobile Verification Toolkit’ or MVT, works with both iOS and Android, and is available for download here.

In its current form, the software is not an easy-to-use experience, has no graphical user interface, and installs on phones’ command line, meaning that basic knowledge of basic coding is needed (details here). The toolkit also requires the download and installation of dependencies to operate.

Once installed, the software allows users to create a backup of their device, check backup files, including artefacts from iTunes’ proprietary backup system, if applicable, extract artefacts from filesystem dumps, and compare stored data with known indicators of compromise. The Android version of the software, which Amnesty says is less fleshed out because of Pegasus’ greater prevalence on iOS devices, includes the ability to check for the download of non-safelisted APKs (apps), and to search for backups for text messages with links to the roughly 700 known NSO domains (Amnesty says this list will be continually updated).

TechCrunch contributor Zack Whittaker tested out the toolkit on an iPhone, and reported that it takes about 10 minutes to get it up and running, plus the time it takes to back up the phone, which is necessary to decrypt locally stored files. The scan itself takes just one to two minutes, and lists possible signs of compromise in the outputted files.

You’ve Got Pegasus – What Now?


Tech experts don’t make it explicitly clear what can be done if Pegasus is found on a device. In a 2019 study, Citizen Lab found that in the case of Android devices, the malware can survive a factory reset on some phones, meaning that the only way to be sure you’re not infected is to get a new phone.

It’s not clear whether NSO Group’s software can survive a hard reset on iOS devices, with Apple tech support reluctant even to admit that its advanced “sandboxed iOS architecture” can be compromised, and recommending software updates to deal with the problem (they don't).

Tech specialists don’t mention it, but another possible way to reduce exposure to Pegasus is to reduce one’s exposure to the digital world.

Journalists, activists, politicians and others who feel vulnerable can do so by using landlines or simple button phones with no internet capabilities for Pegasus to exploit, by engaging in face-to-face meetings instead of voice and text message conversations, using analogue or simple digital voice recorders, etc. If giving up your smartphone is not an option, there’s always the alternative of using a non-Android, non-iOS smartphone, which may be less vulnerable to the Israeli spyware by virtue of its more limited user base.

None of these techniques can guarantee that whoever may be monitoring you illegally won’t be able to do so, but it will at least require a greater effort on their behalf to do so.

Newsletter

Related Articles

0:00
0:00
Close
London Daily Podcast: London Massive Pro Democracy Rally, Musk Support, UK Economic Data and Premier League Results Mark Eventful Weekend
This Week in AI: Meta’s Superintelligence Push, xAI’s Ten Billion-Dollar Raise, Genesis AI’s Robotics Ambitions, Microsoft Restructuring, Amazon’s Million-Robot Milestone, and Google’s AlphaGenome Update
Le Pen Tightens the Pressure on Macron as France Edges Toward Political Breakdown
Musk calls for new UK government at huge pro-democracy rally in London, but Britons have been brainwashed to obey instead of fighting for their human rights
Elon Musk responds to post calling for the murder of Erika Kirk, widow of Charlie Kirk: 'Either we fight back or they will kill us'
Czech Republic signs €1.34 billion contract for Leopard 2A8 main battle tanks with delivery from 2028
USA: Office Depot Employees Refused to Print Poster in Memory of Charlie Kirk – and Were Fired
Proposed U.S. Bill Would Allow Civil Suits Against Judges Who Release Repeat Violent Offenders
Penske Media Sues Google Over “AI Overviews,” Claiming It Uses Journalism Without Consent and Destroys Traffic
Indian Student Engineers Propose “Project REBIRTH” to Protect Aircraft from Crashes Using AI, Airbags and Smart Materials
French Debt Downgrade Piles Pressure on Macron’s New Prime Minister
US and UK Near Tech, Nuclear and Whisky Deals Ahead of Trump Trip
One in Three Europeans Now Uses TikTok, According to the Chinese Tech Giant
Could AI Nursing Robots Help Healthcare Staffing Shortages?
NATO Deploys ‘Eastern Sentry’ After Russian Drones Violate Polish Airspace
Anesthesiologist Left Operation Mid-Surgery to Have Sex with Nurse
Tens of Thousands of Young Chinese Get Up Every Morning and Go to Work Where They Do Nothing
The New Life of Novak Djokovic
The German Owner of Politico Mathias Döpfner Eyes Further U.S. Media Expansion After Axel Springer Restructuring
Suspect Arrested: Utah Man in Custody for Charlie Kirk’s Fatal Shooting
In a politically motivated trial: Bolsonaro Sentenced to 27 Years for Plotting Coup After 2022 Defeat
German police raid AfD lawmaker’s offices in inquiry over Chinese payments
Turkish authorities seize leading broadcaster amid fraud and tax investigation
Volkswagen launches aggressive strategy to fend off Chinese challenge in Europe’s EV market
ChatGPT CEO signals policy to alert authorities over suicidal youth after teen’s death
The British legal mafia hit back: Banksy mural of judge beating protester is scrubbed from London court
Surpassing Musk: Larry Ellison becomes the richest man in the world
Embarrassment for Starmer: He fired the ambassador photographed on Epstein’s 'pedophile island'
Manhunt after 'skilled sniper' shot Charlie Kirk. Footage: Suspect running on rooftop during panic
Effective Protest Results: Nepal’s Prime Minister Resigns as Youth-Led Unrest Shakes the Nation
Qatari prime minister says Netanyahu ‘killed any hope’ for Israeli hostages
King Charles and Prince Harry Share First In-Person Moment in 19 Months
Starmer Establishes Economic ‘Budget Board’ to Centralise Policy and Rebuild Business Trust
France Erupts in Mass ‘Block Everything’ Protests on New PM’s First Day
Poland Shoots Down Russian Drones in Airspace Violation During Ukraine Attack
Brazilian police say ex-President Bolsonaro had planned to flee to Argentina seeking asylum
Trinidad Leader Applauds U.S. Naval Strike and Advocates Forceful Action Against Traffickers
Kim Jong Un Oversees Final Test of New High-Thrust Solid-Fuel Rocket Engine
Apple Introduces Ultra-Thin iPhone Air, Enhanced 17 Series and New Health-Focused Wearables
Macron Appoints Sébastien Lecornu as Prime Minister Amid Budget Crisis and Political Turmoil
Supreme Court temporarily allows Trump to pause billions in foreign aid
Charlie Sheen says his father, Martin Sheen, turned him in to the police: 'The greatest betrayal possible'
Vatican hosts first Catholic LGBTQ pilgrimage
Apple Unveils iPhone 17 Series, iPhone Air, Apple Watch 11 and More at 'Awe Dropping' Event
Pig Heads Left Outside Multiple Paris Mosques in Outrage-Inducing Acts
Nvidia’s ‘Wow’ Factor Is Fading. The AI chip giant used to beat Wall Street expectations for earnings by a substantial margin. That trajectory is coming down to earth.
France joins Eurozone’s ‘periphery’ as turmoil deepens, say investors
On the Anniversary of Queen Elizabeth’s Death: Prince Harry Returns to Britain
France Faces New Political Crisis, again, as Prime Minister Bayrou Pushed Out
Murdoch Family Finalises $3.3 Billion Succession Pact, Ensuring Eldest Son’s Leadership
×