Citizen Lab, working in collaboration with the SHARE Foundation, has confirmed that an iPhone belonging to a member of Serbia's student protest movement was infected with NSO Group's Pegasus spyware. The infection vector was an iMessage zero-click exploit — meaning the target never tapped a link, opened an attachment, or interacted with the message in any way. The device was compromised silently, with forensic artifacts indicating a full Pegasus deployment.

In Citizen Lab's own words: "Our analysis confirmed that an iMessage zero-click security issue was used to infect the device with NSO Group's Pegasus spyware. We found high-confidence indicators" of compromise.

For defenders, this is not an abstract headline. It is a live demonstration that commercial mercenary spyware continues to be deployed against civil society targets in Europe in 2026, that zero-click iMessage exploitation chains remain viable against current iOS builds, and that traditional endpoint defenses — which largely do not exist on iOS — leave high-risk users dependent on network telemetry, forensic methodology, and Apple platform mitigations like Lockdown Mode.

Who should care

• Organizations whose staff are high-risk users: journalists, activists, NGO personnel, government officials, dissidents, lawyers, and executives operating in or around politically sensitive regions.
• SOC teams with visibility into network egress from managed mobile fleets.
• IR/DFIR teams who may be called to triage a suspected spyware case — the methodology is specialized and mistakes destroy evidence.
• CISOs who have not yet scoped mobile spyware into their threat model. If your executives travel, this is your problem.

Technical Analysis

The threat actor and the tooling

Pegasus is NSO Group's flagship zero-click surveillance platform, sold to government customers. Once deployed, it provides near-total device compromise: messages (including end-to-end encrypted apps, read post-decryption on-device), calls, microphone and camera activation, location tracking, keychain credential theft, and file exfiltration. The targeting of a member of Serbia's student protest movement follows a well-documented pattern of Pegasus being used against civil society rather than against legitimate criminal or counterterrorism targets — and it follows prior Citizen Lab and SHARE Foundation findings of spyware abuse in the region.

Attack chain (defender's view)

1. Delivery: A zero-click payload is delivered via iMessage — no user interaction required. Historically, these chains abuse parsing of media (images, PDFs, fonts, audio transcoding) inside iMessage's sandboxed processing daemons (imagent, IMDPersistenceAgent, mediaparserd, BlastDoor). The payload arrives as an invisible or self-destructing message; the target sees nothing.
2. Sandbox escape and privilege escalation: The exploit chain escapes the iMessage/BlastDoor sandbox and escalates to kernel-level execution. Pegasus operators rotate exploit chains frequently; a given campaign typically burns a fresh or privately-held chain.
3. Implant deployment: The Pegasus implant stages from encrypted storage, hooks system processes, and begins collection. On modern iOS it runs largely filelessly or with minimal on-disk footprint and attempts log tampering to hinder forensics.
4. Command and control: The implant communicates with multi-tier operator infrastructure over TLS, often using short-lived, innocuous-looking domains and frequently proxying through cloud services. Citizen Lab's fingerprinting of this infrastructure (their distinctive three-layer C2 architecture) is how many infections have been attributed to NSO Group.
5. Anti-forensics: Pegasus routinely cleans crash logs and unified log entries, which is why forensic absence of evidence in one log source is not evidence of absence — correlation across DataUsage.sqlite, network usage records, and shutdown.log artifacts is required.

Affected platform

• Platform: Apple iOS (iPhone). The victim's device was a current-generation iPhone.
• CVE status: No CVE identifier has been publicly assigned to this specific zero-click chain as of this writing. Do not let the absence of a CVE drive complacency — NSO chains are typically patched by Apple only after discovery and disclosure, and Apple has historically shipped fixes via emergency point releases and Rapid Security Responses. Any CVE fabricated or guessed at in other coverage should be treated as unreliable until Apple publishes a security advisory.
• Exploitation status: Confirmed in-the-wild exploitation against a real target, forensically validated by Citizen Lab with high-confidence indicators. This is not theoretical.

Why this is hard to defend

iOS offers no EDR agent model for third parties. There is no Sysmon for iPhone. Detection therefore rests on three pillars:

1. Network telemetry (DNS, TLS egress, proxy logs) where devices transit managed infrastructure.
2. Post-hoc forensics on the device itself (MVT — Amnesty International's Mobile Verification Toolkit — against sysdiagnose captures, filesystem dumps, or iTunes backups).
3. Apple's platform mitigations — Lockdown Mode in particular, which has demonstrably degraded or blocked zero-click iMessage chains by restricting the very parsing surfaces these exploits abuse (attachment previewing, link previews, JIT compilation, FaceTime from unknown callers, wired connections while locked).

Detection & Response

A candid note before the rules: there is no reliable host-based Sigma rule for Pegasus on iOS, because there is no supported telemetry pipeline off the device. What follows targets the two surfaces where SOCs actually have signal — network egress (C2 resolution/connection) and macOS endpoints (Pegasus operators run parallel macOS chains, and documented implant artifacts exist there). The network rule is designed to be fed by a maintained IOC list from Citizen Lab/Amnesty rather than hardcoding stale domains — that is how this should be run in production.

Sigma Rules

---
title: DNS Resolution of NSO Group Pegasus Command-and-Control Infrastructure
id: 4c7a2e91-6b3d-4f58-a91c-2d8e5f7b0a34
status: experimental
description: Detects DNS queries matching known or suspected NSO Group Pegasus C2 domains. The domain list MUST be synchronized from current Citizen Lab and Amnesty International IOC publications (see references) — mercenary spyware operators rotate infrastructure aggressively and static lists decay within weeks. Deploy against resolver and DNS sensor logs covering segments used by high-risk users (journalists, activists, executives, NGO staff).
references:
  - https://citizenlab.ca/
  - https://github.com/AmnestyTech/investigations
  - https://github.com/mvt-project/mvt
author: Security Arsenal
date: 2026/09/15
tags:
  - attack.command_and_control
  - attack.t1071.001
logsource:
  category: dns
detection:
  selection_ioc:
    query|contains:
      # Populate from the CURRENT Citizen Lab / Amnesty Tech IOC lists.
      # Example format below — replace with live indicators from references.
      - '.pegasus-c2-example.invalid'
  condition: selection_ioc
falsepositives:
  - DNS security research and sandbox detonation of spyware samples
  - Threat intel scanning infrastructure
level: critical
---
title: Pegasus Implant Process Artifacts on macOS Endpoints
id: 8f2b6d14-3e5a-4c79-b82d-1a9f4e6c5d27
status: experimental
description: Detects execution of process names documented in Amnesty International and Citizen Lab Pegasus forensic investigations that have no legitimate presence as standalone executables on macOS. Pegasus operators maintain parallel macOS exploitation chains; the 'bh' process and related artifacts have repeatedly appeared in confirmed Pegasus infections. Intended for macOS fleets monitored via osquery, Jamf Protect, or equivalent process telemetry forwarded as process_creation events.
references:
  - https://github.com/AmnestyTech/investigations
  - https://github.com/mvt-project/mvt
  - https://citizenlab.ca/
author: Security Arsenal
date: 2026/09/15
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: macos
detection:
  selection:
    Image|endswith:
      - '/bh'
      - '/roleaccountd'
      - '/msgaccesd'
      - '/livesd'
      - '/pcsd'
  filter_system_path:
    Image|startswith:
      - '/System/Library/'
      - '/usr/libexec/'
  condition: selection and not filter_system_path
falsepositives:
  - Rare third-party daemons with colliding names — verify binary signature and notarization before escalation
  - Developer tooling in non-standard install paths
level: high

KQL — Microsoft Sentinel / Defender

This query hunts mobile and workstation egress against a Pegasus C2 indicator list, then pivots to show which identities and devices are involved — the triage path an analyst actually needs when a high-risk user's device lights up. It works against Defender-managed endpoints (DeviceNetworkEvents) and any firewall/proxy/DNS telemetry ingested as CommonSecurityLog (CEF). Feed the dynamic list from the Citizen Lab/Amnesty IOC sets and keep it current.

// Pegasus C2 hunt — sync IOCs from Citizen Lab / Amnesty Tech investigations repos
let PegasusC2 = dynamic([
    "pegasus-c2-example.invalid"   // Replace with CURRENT indicators from:
                                   // https://github.com/AmnestyTech/investigations
    ]);
let HighRiskUsers = dynamic([      // Populate from your high-risk-user watchlist
    "journalist@example.com", "activist@example.com"
    ]);
union isfuzzy=true
(DeviceNetworkEvents
| where TimeGenerated > ago(30d)
| where RemoteUrl in (PegasusC2)
| project TimeGenerated, DeviceName, RemoteUrl, RemoteIP, InitiatingProcessFileName, ReportId, Source="Defender"),
(CommonSecurityLog
| where TimeGenerated > ago(30d)
| where DestinationHostName in (PegasusC2)
| project TimeGenerated, DeviceName=DeviceHostName, RemoteUrl=DestinationHostName, RemoteIP=DestinationIP, InitiatingProcessFileName="", ReportId="", Source="CEF")
| extend HighRiskUserHit = iff(DeviceName has_any (HighRiskUsers), "YES", "no")
| summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), ConnectionCount=count(), Sources=make_set(Source) by DeviceName, RemoteUrl, RemoteIP, HighRiskUserHit
| order by HighRiskUserHit desc, ConnectionCount asc   // Low-count, rare-destination hits from high-risk users are priority

The order by ... ConnectionCount asc is deliberate: Pegasus C2 contact from a compromised device is typically low-volume and periodic, not noisy. A single rare-domain hit tied to a high-risk user warrants immediate escalation, not a queue ticket.

Velociraptor VQL — macOS Fleet Hunt

For macOS fleets (and any macOS devices used by high-risk staff), hunt the documented Pegasus process artifacts and persistence artifacts together:

-- Pegasus artifact hunt: processes + launchd persistence on macOS
-- Process artifacts documented in Amnesty/Citizen Lab Pegasus forensics
SELECT Pid, Ppid, Name, Exe, Username, CommandLine,
       CreateTime,
       'ProcessArtifact' AS HitType
FROM pslist()
WHERE Name =~ '^(bh|roleaccountd|msgaccesd|livesd|pcsd)$'
  AND Exe !~ '^/(System/Library|usr/libexec)/'

UNION ALL

-- Non-Apple LaunchDaemons/Agents — Pegasus persistence on macOS is short-lived
-- but staging plists have been observed during implant deployment
SELECT 0 AS Pid, 0 AS Ppid,
       filename(path=FullPath) AS Name,
       FullPath AS Exe,
       '' AS Username,
       '' AS CommandLine,
       timestamp(epoch=Mtime.Sec) AS CreateTime,
       'PersistenceArtifact' AS HitType
FROM glob(globs=['/Library/LaunchDaemons/*.plist',
                 '/Library/LaunchAgents/*.plist'])
WHERE NOT IsDir
  AND FullPath !~ 'com\.apple\.'
  AND (Data = stat(filename=FullPath)).Mtime.Sec > (now() - 2592000)  -- modified in last 30 days

Review every non-Apple launchd item modified in the last 30 days in a high-risk user's context. On a clean corporate macOS build this list is short and stable; anything unfamiliar is worth signature-verifying (codesign -dvvv) before dismissal.

Remediation / Verification Script

For iOS, "patch verification" means two things: confirming devices run the latest iOS build with Rapid Security Responses applied, and — for suspected compromises — running MVT against a forensic capture. This Bash script gives IR teams a repeatable triage workflow for a device consented into investigation:

#!/usr/bin/env bash
# Pegasus / mercenary spyware triage for iOS devices (DFIR use, with owner consent)
# Run on an analysis workstation (Linux/macOS), NOT on the suspect device.
set -euo pipefail

CASE_DIR="${1:?Usage: $0 <case_directory_containing_backup_or_dump>}"
IOC_DIR="${2:-./iocs}"

echo "[*] Installing/refreshing MVT (Amnesty Mobile Verification Toolkit)..."
pip3 install --upgrade mvt >/dev/null

echo "[*] Pulling current spyware IOCs (Amnesty Tech investigations)..."
mkdir -p "$IOC_DIR"
# Amnesty publishes machine-readable STIX2 IOCs per investigation; keep these fresh

```bash
git -C "$IOC_DIR" pull 2>/dev/null || \
  git clone https://github.com/AmnestyTech/investigations "$IOC_DIR"

echo "[*] Running MVT checks against: $CASE_DIR" OUT_DIR="./mvt_results_$(date +%Y%m%d_%H%M%S)" mkdir -p "$OUT_DIR"

Filesystem dump or decrypted backup — mvt-ios handles both

mvt-ios check-backup "$CASE_DIR" --iocs "$IOC_DIR" --output "$OUT_DIR" 2>/dev/null ||
mvt-ios check-fs "$CASE_DIR" --iocs "$IOC_DIR" --output "$OUT_DIR"

echo "[*] High-signal artifact review:" echo " - DataUsage.sqlite / netusage: anomalous data consumers (processes like 'bh')"