Picture this: you are sitting on a government committee investigating one of the most invasive surveillance tools ever built. Then you find out that same tool was running on your phone the entire time. That is exactly what happened to Stelios Kouloglou, a former Member of the European Parliament who served on the PEGA Committee, the body tasked with investigating Pegasus spyware abuses across the EU. According to a Citizen Lab forensic report, his iPhone was infected in October 2022 and again in March 2023, right during key periods of the committee's work.

This is not a story about one compromised phone. It is a story about how commercial spyware has become a serious threat to democratic institutions. And more practically, it raises a question every developer, journalist, and privacy-conscious person should be asking: what does this kind of attack actually look like, and what defenses exist?

What Makes Pegasus So Dangerous

Most people imagine phone hacking requires a victim to click a bad link. Pegasus, built by the Israeli company NSO Group, does not always need that. It uses what researchers call zero-click exploits, attack vectors that require zero interaction from the target. No link to click. No file to open. The spyware installs itself silently.

Once installed, Pegasus can access messages, emails, microphone, camera, and GPS location. It can read encrypted messaging apps like Signal or WhatsApp because it operates at the operating system level, below where those apps encrypt data. By the time encryption kicks in, Pegasus has already seen the content in plain text.

The Kouloglou case also revealed something unsettling about targeting logic. Citizen Lab noted an overlap between his infection timeline and a separate Pegasus campaign targeting Russian and Belarusian-speaking exiled journalists in Europe. This suggests a single Pegasus customer operated across multiple European countries, not a small or unsophisticated actor.

Understanding the threat model matters here. Pegasus is not cheap malware sold on dark web forums. It is sold exclusively to governments, according to NSO Group's own marketing. That changes the calculus for who might be targeted and why. Politicians, journalists, lawyers, and activists face a threat profile that ordinary consumers rarely encounter. But the defensive principles apply broadly.

How These Infections Actually Work: A Technical Look

Zero-click exploits typically target software that processes untrusted data automatically. Think about how your phone handles an incoming iMessage, a voicemail notification, or a calendar invite. All of these trigger background parsing before you ever interact with them. A vulnerability in that parsing code is the entry point.

Here is a simplified view of the infection chain:

Delivery: A specially crafted packet, message, or push notification is sent to the target device. No user interaction needed.
Exploitation: A vulnerability in iOS or Android's background processes is triggered. Memory gets corrupted in a controlled way.
Payload installation: A small loader runs and downloads the full Pegasus implant from a remote server.
Persistence: The spyware embeds itself in ways that survive reboots, though iOS updates can sometimes break it.
Exfiltration: Captured data is sent back to command-and-control servers in encrypted bursts, often mimicking normal app traffic.

Forensic detection, like what Citizen Lab performed on Kouloglou's iPhone, relies on examining system logs, process artifacts, and network traffic patterns. Tools like the Mobile Verification Toolkit (MVT) were specifically built for this purpose. MVT can analyze iPhone backups or Android device data for known Pegasus indicators of compromise (IOCs).

# Install MVT via pip
pip install mvt

# Analyze an iPhone backup for Pegasus IOCs
mvt-ios check-backup --iocs path/to/iocs.stix2 path/to/iphone/backup

# Check a connected iOS device (requires a full backup first)
mvt-ios check-fs --iocs path/to/iocs.stix2 path/to/extracted/fs

MVT is free and open source. It is the same class of tool that Citizen Lab and Amnesty Tech use for forensic work. It will not prevent an infection, but it is the starting point for detecting one. Security teams working with high-risk clients should make this part of their standard toolkit.

Lockdown Mode Is Not a Gimmick

Apple introduced Lockdown Mode in iOS 16 as a direct response to sophisticated spyware like Pegasus. It is an extreme hardening option that disables a wide range of features that zero-click exploits commonly abuse. Most people do not need it. For high-risk individuals, it is worth understanding.

Diagram showing how Pegasus spyware infects an iPhone through a zero-click exploit

What Lockdown Mode actually does:

How Pegasus Spyware Operates

Step 1: Infection

Pegasus uses zero-click exploits to infect devices.

Step 2: Access

Once installed, it accesses messages, camera, and location.

Step 3: Data Collection

Reads encrypted apps like Signal before encryption.

Step 4: Surveillance

Operates silently, collecting data without user knowledge.

Blocks most message attachment types in iMessage
Disables FaceTime calls from unknown contacts
Blocks wired connections to accessories when the phone is locked
Disables shared photo albums and some web browsing features
Prevents configuration profiles from being installed

The tradeoff is real. Some apps break. Some workflows become awkward. But for journalists, lawyers, or anyone who might be a high-value surveillance target, the reduction in attack surface is significant. Apple has also committed to paying security researchers who find bypasses to Lockdown Mode, which creates a financial incentive to keep it hardened.

Lockdown Mode is not a silver bullet. Determined state-level attackers have resources to find new zero-days. But it raises the cost of an attack substantially, which matters when you are talking about spyware that reportedly costs millions of dollars per deployment. Higher cost means fewer targets get hit.

What Developers Can Learn from State-Level Attacks

Here is the thing: most developers are not MEPs. But the lessons from how Pegasus operates map directly onto principles that matter for anyone building or securing software. The Kouloglou case is essentially a master class in what happens when threat modeling is ignored.

The NIST Cybersecurity Framework emphasizes identify, protect, detect, respond, and recover as the five pillars of security. Pegasus attacks expose gaps in all five. Organizations that process sensitive communications, whether EU committees or law firms or medical platforms, often underestimate the detect and respond steps in particular.

Practically, what should developers and organizations take away?

Reduce your attack surface: Every background process that parses untrusted data is a potential zero-click entry point. Minimize what your app processes without user initiation.
Assume breach: Design systems so that a compromised endpoint does not expose everything. End-to-end encryption helps, but key management matters too.
Use hardware security keys: Even if a device is compromised, hardware authentication tokens add a layer that pure software attacks struggle to bypass.
Log and monitor: Anomalous network traffic is often the first detectable sign of spyware activity. Proper logging infrastructure is not optional for sensitive deployments.

For teams working on sensitive applications, it is also worth reading through the AWS security documentation on isolation patterns. Cloud architecture choices have a real impact on what an attacker can reach if a single endpoint is compromised. Network segmentation, least-privilege IAM roles, and encrypted secrets management all reduce blast radius.

If you want to go deeper on the statistics side of vulnerability analysis, tools like our percentile calculator can help security teams benchmark their patch cadence or response times against internal historical data.

The VPN Question Everyone Gets Wrong

After stories like this break, people immediately ask: would a VPN have helped? Honestly, not much. A VPN encrypts traffic between your device and a VPN server. Pegasus operates on the device itself, below the network layer. By the time your data hits the VPN tunnel, spyware has already captured it locally.

That said, VPNs do provide meaningful protection in other contexts. They prevent network-level surveillance, protect against man-in-the-middle attacks on public Wi-Fi, and obscure your traffic from your internet provider. For a journalist traveling to a high-risk country, a VPN is part of a broader defense posture, not a standalone solution. Check out our comprehensive VPN guide if you want to understand where VPNs genuinely help and where they do not.

The broader lesson is that security tools need to match the actual threat. Using a VPN against Pegasus is like wearing a raincoat in a submarine. The threat is coming from a completely different direction.

Detection Tools You Can Actually Use Today

If you work with high-risk clients or are personally in a category that might attract sophisticated surveillance, here are concrete tools worth knowing. These are not theoretical. Citizen Lab and Amnesty Tech have used them in real investigations.

Screenshot of Mobile Verification Toolkit running on a terminal to scan an iPhone backup for spyware

Mobile Verification Toolkit (MVT)

MVT from Amnesty Tech is the gold standard for iOS and Android forensic analysis. It checks device artifacts against known Pegasus and commercial spyware IOCs. It requires some command-line comfort, but the documentation is solid. You can find it at github.com/mvt-project/mvt.

Protecting Against Spyware Attacks

✓

Use Lockdown Mode
Activate iOS Lockdown Mode for enhanced security.

✓

Employ Detection Tools
Use commercial spyware detection tools for safety.

✓

Regular Updates
Keep your device updated to mitigate vulnerabilities.

✓

Limit Permissions
Restrict app permissions to minimize data access.

iVerify

iVerify is a commercial iOS security app that runs automated threat detection scans. It is built on similar forensic logic to MVT but packaged for non-technical users. It caught Pegasus infections in independent testing and is used by some high-risk organizations as a routine monitoring tool.

Wireshark for Network Analysis

Wireshark can capture and analyze network traffic from a device. Spyware often communicates with command-and-control servers in patterns that look unusual compared to normal app traffic. Security researchers use it to spot anomalous outbound connections. It requires expertise to interpret, but it is free and powerful.

GreyKey and Cellebrite: Know the Other Side

Understanding what law enforcement and sophisticated attackers use is also valuable. Tools like Cellebrite and GreyKey are used to extract data from locked phones. Knowing these exist informs decisions about full-disk encryption settings and auto-lock timers. A phone that locks quickly and uses a strong passcode is meaningfully harder to extract data from, even with these tools.

The Bigger Picture: Who Is at Risk

The Kouloglou case is unusual but not unique. Citizen Lab has documented Pegasus infections targeting journalists in Mexico, activists in Saudi Arabia, lawyers in Spain, and now an EU parliamentarian investigating the spyware itself. The pattern suggests that whoever controls these deployments is not shy about targeting people in democratic countries.

What does this mean practically? If you work in investigative journalism, political advocacy, human rights law, or government oversight, your threat model is different from a typical developer or consumer. You should treat your phone as a potentially compromised device if you have been in contact with politically sensitive information.

For everyone else, the lesson is more about systemic awareness. The infrastructure that enables Pegasus, zero-day brokers, private intelligence firms, and government spyware markets, operates largely in legal gray zones. Regulatory responses like the EU's work through the PEGA Committee are one piece of the puzzle. Technical defenses are another. Neither alone is sufficient.

Teams building applications that handle sensitive data can benefit from exploring containerization practices at Docker Docs or reviewing orchestration security patterns in the Kubernetes documentation. Isolating workloads limits how much damage a compromised component can do, which is the same principle that makes Lockdown Mode effective on iOS.

The security community has a lot of good educational resources too. Kaggle Learn covers data analysis fundamentals that underpin forensic work. And if you are thinking about content security for a team or organization, Buffer's resource library covers secure communication practices for distributed teams.

Start Taking Mobile Security Seriously

The Kouloglou case is a wake-up call, not just for politicians, but for anyone who handles information that someone powerful might want. Commercial spyware is real, it is being used against people in democratic countries, and it is sophisticated enough to evade most consumer-level defenses.

The good news is that defenses exist. Lockdown Mode, MVT, hardware security keys, and thoughtful network architecture all raise the cost of attacks. No defense is perfect, but making yourself an expensive target reduces your risk meaningfully.

If you work in a high-risk field, start with a forensic scan using MVT today. Read up on the NIST Cybersecurity Framework to understand where your organization's gaps are. And check out our comprehensive VPN guide to understand where network-level tools actually fit into your defense stack. Security is not one tool. It is a layered posture built with clear eyes about what you are actually defending against.