⚠️ DISCLAIMER: This repository is for educational and research purposes only. It does not contain malicious code. The goal is to document the mechanics of advanced "mercenary" spyware like Pegasus and provide legitimate prevention resources for at-risk individuals.
- 1. What Pegasus Is & How It Works
- 2. Symptoms of Infection
- 3. Forensic Detection Methods
- 4. Removal Reality
- 5. Prevention & Protection (2026 Best Practices)
- Research Sources & Tools
Pegasus is a highly sophisticated spyware suite developed by the NSO Group. It targets iOS and Android devices to covertly extract data. It is not publicly sold; it is licensed exclusively to government agencies for high-profile surveillance of journalists, activists, and officials.
- Zero-Click Exploits: The primary threat. Pegasus infects devices without any user interaction by exploiting "zero-day" vulnerabilities in messaging protocols like iMessage (e.g., FORCEDENTRY) or WhatsApp.
- Traditional Phishing: Older variants used malicious links, but modern deployments focus on silent, non-interactive exploits.
- Radio Interfaces: Can be delivered via wireless transceivers located near a target.
Once Pegasus gains root (Android) or jailbreak (iOS) privileges at the OS kernel level, it can:
- Monitor Comms: Read encrypted messages (Signal, WhatsApp) by scraping data before/after encryption.
- Surveillance: Activate the microphone and camera silently.
- Tracking: Harvest real-time GPS data and location history.
- Data Theft: Access photos, emails, contacts, and keychain passwords.
Pegasus is designed for stealth, but researchers watch for these "side-channel" indicators:
- 🔋 Abnormal Battery Drain: Due to hidden background processes.
- 📡 Data Spikes: Sudden increases in network activity (data exfiltration).
- 🌡️ Device Heat: The processor running hidden tasks at high intensity.
- ❌ System Instability: Random crashes, app freezes, or unexplained reboots.
- 🌐 Network Anomalies: Traffic directed to unknown Command & Control (C&C) servers.
Standard antivirus software is generally ineffective. Detection requires specialized forensics:
Developed by Amnesty International, MVT analyzes device backups for Indicators of Compromise (IoCs) like suspicious domains or altered system logs.
Researchers analyze files like Shutdown.log (iOS) for anomalies.
- Note: In 2026, newer variants may attempt to wipe these logs; a missing log can sometimes be an indicator of tampering.
- The Reboot Strategy: Many exploits are non-persistent. Restarting your device daily can clear the current infection from memory, though it does not prevent re-infection.
- Factory Reset: May remove the agent but is not 100% guaranteed if the spyware has achieved deep system-level persistence.
- The Nuclear Option: For confirmed high-risk targets, the only certain solution is to discard and replace the physical device.
- Lockdown Mode (iOS): Extremely effective. It strips the OS of complex features (like iMessage link previews) that Pegasus exploits.
- Update Everything: Security patches from Apple and Google are your first line of defense against known zero-day exploits.
- Daily Reboots: Forces the attacker to attempt a fresh re-infection, increasing the chance of detection.
- Minimize Exposure: Disable iMessage and FaceTime if you are in a high-risk category to remove common "zero-click" entry points.
- Amnesty International Security Lab
- The Citizen Lab (University of Toronto)
- MVT Project (GitHub)
- Apple’s Guide on Lockdown Mode
For questions regarding the research documented here:
- Administrator: Contact via Telegram