Who spyware is aimed at: journalists, officials and the people around them

Summary

• In July 2021 a media consortium and Amnesty International reported a leaked list of about 50,000 phone numbers said to be selected for surveillance by customers of NSO Group. It included at least 180 journalists in 20 countries. NSO disputed the reading of the list.
• A list is not an infection. Amnesty's lab examined 67 phones and found 23 successfully infected, 14 with signs of an attempt and 30 inconclusive. The list's purpose was never conclusively determined.
• Later forensic cases confirm real targeting of journalists, an activist's family and officials: 35 people in El Salvador, the daughter of Paul Rusesabagina, with phones in the United States and Belgium, U.S. State Department employees, and a European Parliament member who sat on the committee investigating spyware.
• U.S. authorities responded with trade listings, an executive order, sanctions and, in a private suit, a federal court ruling that bars NSO from attacking WhatsApp.
• An examiner can confirm what a device shows. Naming who ordered an attack is a separate question, and the best research groups say so.

The Pegasus Project list

On 18 and 19 July 2021 Forbidden Stories, a journalism nonprofit, and Amnesty International's Security Lab reported on a leaked set of more than 50,000 records of phone numbers that NSO Group customers had chosen for surveillance. More than 80 journalists from 17 outlets took part. They reported that at least 180 journalists in 20 countries had numbers selected by at least 10 customers. Amnesty named 11 countries with potential customers: Azerbaijan, Bahrain, Hungary, India, Kazakhstan, Mexico, Morocco, Rwanda, Saudi Arabia, Togo and the United Arab Emirates.

NSO denied the reporting. It called the premises wrong assumptions and uncorroborated theories, said 50,000 numbers could not be a list of Pegasus targets, and said it cannot confirm or deny who its customers are.

The Washington Post, a consortium partner, reported that it had identified more than 1,000 people on the list. Figure 1 shows the counts as relayed by CNN Business.

What the forensics added is a short list: Amnesty's Security Lab examined 67 phones, of which 23 were successfully infected, 14 showed signs of an attempted infection and 30 were inconclusive, in several cases because the phones had been replaced. That is a statement about the phones examined, not about the 50,000 numbers.

Why these groups

The sources do not set out why each group is chosen. The Lab's reading, from how the cases below unfold, is that each group holds something that is valuable to someone watching and hard to obtain by other means (Figure 2). This is interpretation and is labeled as such.

Cases in the public record

El Salvador: independent journalists

In January 2022 the Citizen Lab and Access Now reported that 35 people with 37 devices had been infected with Pegasus between July 2020 and November 2021. About 22 were journalists of El Faro, an independent news outlet, and others came from several other media houses and from civil society groups. The investigation began in September 2021 when independent journalists tested their phones with Amnesty's toolkit and contacted Access Now's Digital Security Helpline, and Amnesty's Security Lab reviewed a sample of cases. The authors said they were not conclusively attributing the attacks to a particular government customer. They described circumstantial evidence pointing to a government link, including the timing of infections against sensitive government stories, and said there was no conclusive technical proof. They also noted that Pegasus can delete evidence of exfiltration.

The daughter of Paul Rusesabagina, in the United States and Belgium

Carine Kanimba, daughter of Paul Rusesabagina, testified to the U.S. House Intelligence Committee on 27 July 2022. In an interview published in August 2022 she said Amnesty found Pegasus on her Belgian phone and the Citizen Lab found traces on her U.S. phone. The two groups' estimates of the Belgian phone's start date differed (January 2021 and September 2020). She attributes the surveillance to the Rwandan government, which the interview notes has denied any role. NSO told the interviewer that it investigates any claim of illegal use by customers and ends contracts when illegal use is found.

U.S. State Department employees

Reuters reported in December 2021 that at least nine State Department employees based in Uganda or working on Ugandan matters had iPhones hacked with NSO's spyware. Reuters said it could not determine who launched the attacks. NSO said it had no indication its tools were used, canceled access for the relevant customers and would investigate. NSO has said its system does not work on phones with U.S. +1 numbers; two sources told Reuters the employees' phones had foreign numbers.

A member of the committee that investigated spyware

In July 2026 the Citizen Lab reported high-confidence Pegasus infections of the phone of Stelios Kouloglou, a former Greek member of the European Parliament who was a substitute member of its spyware inquiry committee from March 2022 to July 2023. The infections date to 21 October 2022 and to 6 and 7 March 2023. The lab said it could not conclusively attribute them to a government agency, found no indication that the Greek government was responsible, and said additional infections could have gone undetected.

How U.S. authorities and courts have responded

• Trade listing, November 2021. The Commerce Department's Bureau of Industry and Security added NSO Group and another Israeli firm, Candiru, to its Entity List. It said they supplied spyware to foreign governments that used it to target officials, journalists, businesspeople, activists, academics and embassy workers. It applied a presumption of denial to export licenses for them.
• Executive order, 27 March 2023. Executive Order 14093 limits federal agencies' operational use of commercial spyware that poses counterintelligence or security risks or a risk of improper use by a foreign government. It lists journalists and activists among those whose information has been collected to intimidate them. We did not check whether it remains in force.
• Sanctions, March 2024. The Treasury designated two people and five entities tied to the Intellexa Consortium, the group behind the Predator spyware, saying the spyware has been used to target Americans, including U.S. government officials, journalists and policy experts.
• A private suit. WhatsApp sued NSO in 2019 over a flaw used to deliver spyware to about 1,400 users. In December 2024 a judge found NSO liable. In May 2025 a jury awarded over 444,000 dollars in compensatory damages and 167 million dollars in punitive damages, which the judge cut to just over 4 million dollars on 17 October 2025 while granting a permanent injunction that bars NSO from hacking WhatsApp. NSO denies wrongdoing and argues it is not responsible for how its customers use its products.

What an examiner can and cannot conclude

An examiner can say whether indicators of a named spyware family are present on a device, and which records they came from. An examiner can report that a number appears on a published list, with the caution that the list is not evidence about that phone. An examiner can place infection dates against a person's work, as the El Salvador and European Parliament reports did, and say that the timing is consistent with, but does not prove, a purpose.

An examiner cannot say who paid for the attack from the device alone. The research groups behind every case above stopped short of that, and several said so in their reports. An examiner also cannot say that a person never was targeted because a scan came back clean: public indicator lists lag, records roll over, and some operators remove traces. Lab work on empty results sets out when that reading is allowed (LAB-TR-0034). A person on a list, or sent a device-maker notice, may need a full forensic examination before anyone can say more.

What people in these roles can do

The public record points to a few steps that cost little. Keep the phone updated. Consider Lockdown Mode if you have good reason to think you are targeted: Apple describes it as optional, extreme protection for a very small number of people. If Apple sends a threat notification, Apple says to confirm it by signing in at account.apple.com yourself and never to follow a link in it. The notices go to a small number of users and, according to the Citizen Lab, are typically sent in batches, often months after targeting. For expert help, Access Now's Digital Security Helpline offers free support to journalists, activists and civil society groups. Read LAB-0014 for what everyday signs can and cannot tell you.

Handling sources is a separate duty. A compromised device may expose people who trusted the owner, so a journalist or official who finds evidence of a compromise should consider who else needs to be told. The sources we read do not address newsroom policy, and we make no claim about it.

What this article does not claim

Sources

Every claim and where it comes from. Pages were read on 2026-11-08. Pages the Lab's tools could not read (the Washington Post, the Guardian, OCCRP) are not cited. Numbers that could not be sourced were left out.

Version history and corrections

Corrections log

No corrections have been published for this article. Corrections to any article are listed on Corrections, with the version they apply to.

Related