Table of Contents
Introduction
Pegasus spyware made headlines in 2021 as a tool capable of silently infecting a phone without the owner clicking anything.
Five years later, the story has a major new chapter: a US court has ordered NSO Group, the Israeli firm behind Pegasus, to pay WhatsApp over $167 million in damages.
Here’s what Pegasus actually does, how the lawsuit unfolded, and what it means for your own device security.
What Pegasus Spyware Is
Pegasus is spyware developed by NSO Group that, once installed on a phone, can access messages, calls, photos, location data, and even activate the microphone and camera — all without the device owner’s knowledge.
It has historically been sold to government clients, with NSO stating its intended use is targeting terrorists and criminals, though independent investigations have found it used against journalists, activists, and politicians as well.
How It Infects a Device
Some Pegasus infections have required no interaction from the victim at all — a “zero-click” exploit. In the case central to the 2026 ruling, NSO exploited a zero-day vulnerability in WhatsApp’s voice-calling feature (tracked as CVE-2019-3568) to install Pegasus on approximately 1,400 devices in October 2019, without victims needing to answer the call.
The 2026 WhatsApp Court Ruling
In 2026, a US jury ordered NSO Group to pay WhatsApp over $167 million in punitive damages plus roughly $444,000 in compensatory damages, following a five-year legal battle.
The court found NSO liable for violating the Computer Fraud and Abuse Act, breaching California’s Computer Data Access and Fraud Act, and breaking WhatsApp’s terms of service.
The court also noted NSO repeatedly failed to produce key evidence, including Pegasus source code, during the case. NSO has stated it will appeal.
How to Protect Yourself
● Keep your phone’s operating system and apps updated — many Pegasus infections exploited vulnerabilities that were later patched
● Be cautious of unexpected links or attachments, even though some Pegasus infections required no click at all
● Restart your phone regularly, which can disrupt some forms of spyware that don’t achieve persistence across reboots
● Use Apple’s Lockdown Mode or equivalent high-security device settings if you believe you may be a high-risk target (journalist, activist, government official)
Conclusion
Last updated: October 2026.
Pegasus remains one of the most sophisticated commercial spyware tools known, and the 2026 court ruling against NSO Group marks a significant legal consequence for its misuse — though NSO’s appeal means the story isn’t fully resolved.
Keeping your devices updated and restarting them regularly remains the most practical everyday defense against spyware exploiting known vulnerabilities.
Frequently Asked Questions
How did the Pegasus Disclosure happen?
The Forbidden Stories website and Amnesty International were granted access to 50,000 NSO customer phone numbers for observations and investigations. After investigations, it was disclosed that NSO makes Pegasus spyware.
How Many Media Agencies Worked For the Investigation of this Spyware?
About 17 media agencies worked to reveal Pegasus.
How Sure is Spying With Pegasus?
Using Pegasus ensures that the targeted device will be infected. As researchers at the Citizen Lab also clarified after the legal investigation of infected devices, a phone can get easily infected even with a WhatsApp missed call. A Canadian technology firm also examined the devices and confirmed the infections.
Can Pegasus infect a phone without the owner clicking anything?
Yes — some Pegasus infections, including the one central to the 2026 WhatsApp ruling, used “zero-click” exploits that required no action from the victim, such as answering a call.
Is NSO Group still operating in 2026?
Yes, though it is now appealing the $167 million damages ruling from the WhatsApp lawsuit and continues to face ongoing legal and regulatory scrutiny internationally.
How do I know if my phone has Pegasus on it?
Detecting Pegasus typically requires forensic tools like Amnesty International’s Mobile Verification Toolkit — there’s no simple built-in check, since the spyware is specifically designed to avoid detection.
Disclosure: This article is general information, not professional security or legal advice. If you believe a device has been compromised, consult a qualified security professional.
