Pegasus spyware: How it works and how to detect it

30 Jul 2021

Image: © Curioso.Photography/

Paul Haskell-Dowland and Roberto Musotto from Edith Cowan University explain the workings of Pegasus spyware and how to find out if your phone is infected.


A major journalistic investigation has found evidence of spyware, a form of malicious software, being used by governments around the world, including allegations of spying on prominent individuals.

From a list of more 50,000 phone numbers, journalists identified more than 1,000 people in 50 countries reportedly under surveillance using the Pegasus spyware. The software was developed by the Israeli company NSO Group and sold to government clients. [NSO Group has temporarily blocked several government clients around the world from using its technology as it investigates possible misuse.]



How does Pegasus spyware infect phones?

The Pegasus spyware can infect the phones of victims through a variety of mechanisms. Some approaches may involve an SMS or iMessage that provides a link to a website. If clicked, this link delivers malicious software, or malware, that compromises the device.

Others use the more concerning ‘zero-click’ attack where vulnerabilities in the iMessage service in iPhones allows for infection by simply receiving a message, and no user interaction is required.




Rooting and jailbreaking both remove the security controls embedded in Android or iOS operating systems. They are typically a combination of configuration changes and a ‘hack’ of core elements of the operating system to run modified code.


Why have iPhones been targeted by Pegasus?

Most media reports on Pegasus relate to the compromise of Apple devices. The spyware infects Android devices too, but isn’t as effective as it relies on a rooting technique that isn’t 100pc reliable. When the initial infection attempt fails, the spyware supposedly prompts the user to grant relevant permissions so it can be deployed effectively.

Apple devices are generally considered more secure than their Android equivalents, but neither type of device is 100pc secure.

Apple applies a high level of control to the code of its operating system, as well as apps offered through its app store. This creates a closed system often referred to as ‘security by obscurity’. Apple also exercises complete control over when updates are rolled out, which are then quickly adopted by users.


On the other hand, Android devices are based on open-source concepts, so hardware manufacturers can adapt the operating system to add additional features or optimise performance. We typically see a large number of Android devices running a variety of versions – inevitably resulting in some unpatched and insecure devices (which is advantageous for cybercriminals).



How can I tell if Pegasus spyware is on my phone?



The (relatively) easy way to determine this is to use the Amnesty International Mobile Verification Toolkit. This tool can run under either Linux or MacOS and can examine the files and configuration of your mobile device by analysing a back-up taken from the phone.


In particular, the tool can detect the presence of specific software running on the device as well as a range of domains used as part of the global infrastructure supporting a spyware network.

How do I protect myself from spyware?

Unfortunately there is no current solution for the zero-click attack. There are, however, simple steps you can take to minimise your potential exposure – not only to Pegasus but to other malware attacks too.

First of all, only open links from known and trusted contacts and sources when using your device. Pegasus is deployed to Apple devices through an iMessage link. This is the same technique used by many cybercriminals for both malware distribution and less technical scams. The same advice applies to links sent via email or other messaging applications.



Although it may sound obvious, you should limit physical access to your phone. Do this by enabling pin, fingerprint or facial recognition unlocking on the device.

Also, avoid public and free Wi-Fi services (including hotels), especially when accessing sensitive information. The use of a VPN is a good solution when you need to use such networks.


The Conversation

By Paul Haskell-Dowland and Roberto Musotto

Associate professor Paul Haskell-Dowland is associate dean of computing and security at Edith Cowan University (ECU) in Perth, Australia. He has more than 20 years’ experience in cybersecurity research and education in both the UK and Australia. Roberto Musotto is a qualified lawyer and research fellow at ECU with expertise in both the commercial and cyber aspects of serious crimes.