How can Pegasus spyware bypass the security of your phone or apps?

Pegasus, the notorious spyware, was created in 2010, but it wasn’t until six years later that its existence was revealed following an intriguing phishing incident. In 2016, a human rights activist received a text message promising information about alleged prisoner abuse in the United Arab Emirates. Instead of acting impulsively, the recipient decided to take cautious action and shared the message with the University of Toronto’s Citizen Lab, an organization specializing in the study of online threats at the Munk School of Global Affairs.

In collaboration with Lookout, a foundation dedicated to security and privacy, researchers discovered that Pegasus used malware to exploit a design vulnerability in iPhone devices, allowing it to gain unrestricted access.

Developed by NSO Group, a cyber intelligence company based in Israel, Pegasus has constantly evolved, anticipating the security measures adopted by Apple to protect the iOS and Android operating systems. This spyware has evolved from its initial spread via short text messages to the implementation of “Zero click” attacks. This is alarming as it does not require the user to take any action from their device. It can be introduced by simply sending a WhatsApp or iMessage message or by making a missed call without the need for the other party to read or answer the message. Pegasus camouflages itself practically undetectably on both iOS and Android, being highly effective in what are known as Zero day attacks, in which the phone manufacturer has no prior knowledge of the exploited vulnerability.