Pegasus Spyware: The Zero-Click Spyware Infecting Smartphones

Back in June, it was discovered that Pegasus Spyware, specifically developed to track criminals and terrorists, made its way to more than 50,000 phone numbers, some of which included heads of state governments, presidents, and prime ministers. Because this spyware was discovered on the devices of the world’s elite, everyday smartphone users are left wondering if this spyware is lurking within their devices and if it is, how they can detect it and remove it. Below, we’ll dive into Pegasus Spyware, helping you determine your risk and what you can do if you’ve been infected. 

Spyware is something that the world has known about since 1995, introduced as an interchangeable word to refer to adware and malware. It wasn’t until the turn of the century that spyware started to evolve, becoming one of the most dangerous threats on the web. In 2021, spyware has become a whole new beast, especially as the global use of electronics, specifically cell phones, is on the rise. 

What is Pegasus Spyware?

Pegasus is advanced spyware created by Israel’s renowned technology firm, NSO Group. Specifically designed to target smartphones, Pegasus doesn’t discriminate, creating a risk for all devices within the platform trifecta Android, iOS, and Blackberry.

Like other types of spyware, Pegasus is designed to gain access to devices. While other traditional spyware is mainly acquired via mobile vulnerabilities, Pegasus is installable on devices via apps like WhatsApp, leaving no traces behind. Other spyware usually requires the installation of a malicious app (primarily via jailbreaking and rooting) or the click of a malicious link that led to the installation of spyware on the device.

Pegasus is so powerful because it requires the user to do nothing, taking advantage of a known vulnerability in apps like iMessage. Once embedded into a device, Pegasus spyware can access all apps, including those with access to real-time details like cameras and microphones. It’s not easily detectable and can linger in devices long enough to collect sensitive information.

According to statements from the NSO Group, the only entities with access to Pegasus software are “the military, law enforcement, and intelligence agencies from countries with good human rights records.” Though their intentions might be good, that didn’t keep some countries from restricting use, including the United States and France.

Those that may be more vulnerable are activists, journalists, businesspeople, known criminals, government leaders and anyone connected to them that is suspected of a crime. Currently, NSO Group is not releasing clients, so it’s unclear whether or not those that are vulnerable or targeted are regulated.

Because of these spyware discoveries, Pegasus spyware is starting to get a negative reputation across the globe, with many world leaders concerned with their privacy and national security. Apple is among the first platforms to sue NGO groups, though others are expected to follow suit. When notified about the lawsuit and the implications they were facing, NGO Group did not admit to any wrongdoing and claimed that their product nor procedure were not breaking any law. In fact, they pointed out their strong suit, claiming “authorities combat criminals and terrorists who take advantage of encryption technology to avoid detection.”

How does it infiltrate a phone?

Pegasus spyware is more sophisticated than other types of spyware, able to infect devices without user interaction. Pegasus works by targeting zero-day vulnerabilities, which are vulnerabilities that cybersecurity experts are not yet familiar with. The attack is considered zero-click and typically infects smartphones with vulnerable apps.

Recently, Apple discovered that the spyware was targeting iOS messenger because of a vulnerability not yet patched. Because there is no user involvement required and no noticeable changes to infected devices, it can be difficult to detect. At the moment, there doesn’t seem to be a tool to directly detect Pegasus spyware, though there are ways to understand risk.

Assessment of risk is perhaps the most aggressive measure against Pegasus spyware, though users can do other things to detect its presence on their device.

There is some good news for those who have a smartphone and are worried about the presence of spyware. Though 50,000 numbers have been listed as infected, it is not just an ordinary list of people. Those 50,000 were linked to several government officials, political activists, journalists, and those involved in their country’s politics.

That means that most smartphone users are excluded, though that doesn’t make most feel at ease. Spyware of any kind can infect devices, which is why it’s helpful to know how to detect it. Due to Pegasus spyware’s sophistication, it’s not detectable with just any antivirus, leaving users to seek other detection methods.

One popular method of detection that works on all devices is Amnesty International Mobile Verification Toolkit.

This toolkit is compatible with Linux and macOS, searching the device for unknown items that could represent a malware infection. Because news of this spyware is novel, it’s not yet set up to work 100%. While it will not detect Pegasus spyware directly, it alerts smartphone users of “indicators of compromise,” showing an infection on the device. 

Though Amnesty International’s toolkit seems promising, cybercriminals are always trying to stay one step ahead in their methods of defeat. Word of a recent campaign to trick users looking for a way to protect their devices hit newsstands in early October, with a group of cybercriminals disguising themselves as Amnesty International. For those looking for a way to detect Pegasus spyware on their device, Amnesty International is a safe bet. However, they should only inquire about information from the actual website and avoid clicking any unknown third-party links.

An additional option for iOS users that shows promise for detecting Pegasus spyware is Apple’s very own iMazing. This optional scan was created to scan devices to provide evidence of spyware. Installing it on devices is simple and comes with a guided process that takes about 30 minutes. iMazing will scan each app on the device and check for malicious content, creating a detailed report that users can access to find out whether or not they have items on their device that require attention. 

Spyware is different from other types of attacks in that it turns the cell phone into a surveillance device. The longer that spyware is left on a device, the more information it can gather and the more harm it can potentially cause. A few of the most common security implications due to Pegasus software include copying and sending private messages, recording phone calls, and collecting photos both taken on the device and received from messages and apps.

Pegasus can even gain access to users’ microphones and cameras, spying on users without their knowledge. Because of this powerful ability, users with Pegasus spyware installed on their device could have someone monitoring their phone calls and starting the device’s camera without their knowledge, falling victim to severe implications if any wrongdoing is suspected.

For most smartphone users, access to such information will not be lead to criminal action, though it could cause issues with loved ones or professionally. However, because Pegasus targets criminals, world leaders, and other important figures across the globe, some captured information could lead to further investigations.

Apart from the ability to monitor those who might cause harm, Pegasus spyware could create danger if the information is passed into the wrong hands. National and international security could be in harm’s way, and other sensitive details could result in increased criminal activity. Companies too could face implications if collected information falls into the wrong hands, with others able to predict their next move.

Because of these serious security implications that companies are taking action, including global giants like Amazon. They, like others, are making moves to restrict and even shut down services linked to Pegasus spyware. Though companies are taking action on their own, cybersecurity experts are closely monitoring for increased malicious activity and attempting to stop further infections of Pegasus spyware until proper regulations can be put in place.

Can Pegasus Spyware be removed from a device?

Because this spyware is new, sophisticated, and not very well understood, there is not currently a removal solution. These zero-day vulnerabilities created with help from knowledgeable cybercriminals are very difficult to patch until developers find a solution to mitigate them. Even though it’s not removable at the moment, there are some ways that those who are at risk for Pegasus spyware (and any other spyware) can protect themselves.

One of the most effective defenses is active and frequent monitoring of devices, including regular scans to detect suspicious activity. The more active users are running scans and monitoring all activity, the better they will be at detecting spyware and stopping it before it can infect devices and escape without being noticed. In addition to a plan to scan and monitor, users can take other precautions, a few of which we’ll mention below.

Since smartphones are targeted by Pegasus spyware, users should first secure their devices. There are several ways that users can do this, including keeping their devices updated with the latest version, updating all apps when necessary, and getting on a monitoring and scanning schedule.

Frequent monitoring is recommended, with regular users running scans at least once a week. This should ensure that there is no new suspicious activity or installations that could indicate a security breach.

Securing your Data

In addition to protecting devices, it is recommended that companies protect their data. Data is one of the most valuable targets online, with data breaches reaching all-time highs in 2020 and expected to continue to increase in 2021 and 2022. Smartphone users are encouraged to protect their data by managing their permissions in all apps (especially those with access to sensitive details) and ensuring that all passwords are up to date and secure.

Mobile phones often ask for permissions to access apps and other connected devices, which could lead to an additional vulnerability. If there is sensitive information on any device connected to a smartphone, users are encouraged to avoid permitting access to prevent further complications and risks.

Securing your Network

It’s not just about securing mobile devices but also the network to which they are connected. In 2021, most areas feature free wi-fi, though users don’t always consider risks. Public network attacks are on the rise as more and more smartphone users demand access to wi-fi on the go.

There are several ways users can protect themselves and their network, including utilizing advanced security suits that protect each layer. Frequent monitoring of networks and scanning for unknown connections and devices is one place to start, helping users identify understand if something needs their attention.

It’s not just necessary to protect from known attacks but also to have the capability to protect and prevent zero-day attacks too. These days, users are encouraged to use antivirus and other security tools that can help isolate and patch attacks with help from automation.

Pegasus spyware protection

Because Pegasus spyware is linked to two apps, it’s recommended that users take steps to disable each of them if possible. The two most common attacks have been with WhatsApp and iMessage, both of which can be disabled by users.

Pegasus is different than other spyware and can infect systems without user interaction, so at this time, there is not a specific fix. For now, it’s recommended to keep internet access secure, limit others’ access to devices, get on a scanning schedule to check for vulnerabilities, stay up to date on the latest iPhone and Android news, and update when necessary to prevent access.

Are you concerned about the cybersecurity of your company? Edge Networks can help! If you’d like to find out how your company is performing and isolate weaknesses in your cyber defenses, schedule a call with us .