Pegasus & co.: when your phone becomes the bug
“But I have an iPhone.” That reassurance doesn’t survive contact with reality. Commercial mercenary spyware — above all Pegasus by NSO Group, but also Predator/Intellexa and others — turns smartphones into full bugs: microphone, camera, messages, location, everything.
Zero-click: no tap required
The insidious part: many infections need no interaction. A so-called zero-click exploit arrives, for example, via a crafted message (iMessage, WhatsApp) you never have to open. This has been documented by Citizen Lab and Amnesty International, among others — targets have repeatedly been journalists, activists, lawyers and dissidents.
Both platforms affected
Neither iOS nor Android is immune. Apple is considered hardened — yet there have been Pegasus infections on iPhones. On Android, much depends on how much attack surface the system and installed apps expose. No operating system is “safe”; it’s about attack surface and depth of defence.
Shrink the attack surface
- Less is more: as few apps as possible, no unnecessary messengers. Every app is a potential entry point.
- Hardened system: on Android, GrapheneOS substantially reduces the attack surface (the base of our ZERO phones). On iPhones, Lockdown Mode helps.
- Update immediately: patches close known exploits — delay is risk.
- Compartmentalise & reboot: separate profiles; regular reboots evict some (non-persistent) implants.
- Hardware level: for high-risk profiles, physically removing microphones/cameras is the uncompromising option — what’s compromised in software can’t listen through hardware that doesn’t exist.
Detection is hard
Mercenary spyware is built for invisibility. Amnesty’s Mobile Verification Toolkit (MVT) can find forensic traces, but it’s not a casual tool. The honest message: don’t rely on detection — rely on a small attack surface.
Why this drives us
This exact threat model is why hardened, auditable hardware and data minimisation are not a luxury. Not everyone is a Pegasus target — but the principles that defend against it make every device better.