Despite NSO Group’s claims, spyware has continued to target journalists, dissidents and protesters. Saudi journalist and dissident Jamal Khashoggi’s wife, Hanan Elatr, was allegedly managed with Pegasus before his death. In 2021, New York Times journalist Ben Hubbard found out his phone had been attacked twice with Pegasus.
Pegasus was silently implanted on the iPhone Claude Magninpolitical activist’s wife Naama Asfari, who was imprisoned and allegedly tortured in Morocco. Pegasus has also been used for targeting Pro-democracy protesters in Thailandrussian journalist Galina Timchenkoand UK government officials.
In 2021, Apple introduced a lawsuit against NSO Group and its parent company to hold it responsible for “surveillance and attacks on Apple users.”
The case is still ongoing, with NSO Group trying dismiss the lawsuit, but experts say the problem won’t go away as long as spyware vendors are allowed to operate.
David Ruiz, chief privacy advocate at security firm Malwarebytes, blames “the obsessive and oppressive operators behind spyware, compounding its danger to society.”
The Spyware Drain
If you’re faced with a no-click exploit that delivers spyware, experts say there’s very little you can do to protect yourself or restore the security of your devices. “The best thing you can do if you’re a target is to completely abandon both the hardware and any associated accounts,” says Aaron Engel, chief information security officer at ExpressVPN. “Get a new computer, get a new phone number, and create entirely new accounts tied to the device.”
Detecting spyware can be a challenge, but unusual behavior, such as a rapidly draining battery, unexpected shutdowns, or high data usage, could be indicative of an infection, says Javvad Malik, leading online security awareness advocate. security training organization KnowBe4. While specific apps claim to detect spyware, their effectiveness can vary and professional assistance is often needed for reliable detection, he says.
Chris Hauk, consumer privacy advocate at Pixel Privacy, agrees that battery consumption is a strong indicator of spyware on your device. “Most spyware is not developed to run efficiently,” he says.
Users should also be aware of apps they have not installed, forced redirects due to browser hijacking, and changes to their default browser or search engine settings.
Earlier this year, the Kaspersky team inserted a method to detect infection indicators of iOS spyware such as Pegasus, Reign and Predator. It’s effective because Pegasus infections leave traces in the unexpected system log, Shutdown.log, stored in the sysdiagnose file on iOS devices, the security team says.
Another step you can take to protect your device is to make sure you restart it at least once a day. “This requires attackers to reinfect repeatedly, increasing the chances of detection over time,” says Larin.
If you may be a target, you can also disable iMessage and FaceTime to reduce the risk of falling victim to no-click attacks. At the same time, keep your device updated with the latest software and avoid clicking on links received in messages such as emails.
“Update to the latest version of software to protect against known vulnerabilities, use multi-factor authentication, and only install apps from verified and legitimate sources,” says Adam Price, cyber threat intelligence analyst at Cyjax.
If you become a victim, there are helplines available to help you remove spyware, such as Access Now’s Digital Security Helpline and Amnesty International Security laboratory. Meanwhile, Apple’s Lock Mode, which disables certain features but is surprisingly usable, can protect your iPhone from becoming infected in the first place.
