ChrysaorMalware
- jigglypuff
- Pegasus
Last reported 3 days ago, by Security Affairs20 reports
ATT&CK techniques
6 of 9 · each with the sentence it comes from- T1684Social Engineering
“Iranian-linked social-engineering campaign targeted dissidents, activists and journalists”
- T1014Rootkit
“XWorm now also includes a rootkit, a GPS location data harvester, and a webcam and microphone recording module—bringing it closer to a spyware strain than an infostealer.”
- T1053.005Scheduled Task
“The phishing emails are delivering malicious archive files that use virtual hard disks to create scheduled tasks that periodically run the group's malware.”
- T1110Brute Force
“The checkm8 vulnerability is especially relevant today because it is being exploited by many various vendors, who use it to brute-force passcodes on iOS devices.”
- T1176.001Browser Extensions
“Malicious browser extensions: Security researchers have discovered a cluster of more than 30 malicious Chrome extensions posing as financial advice tools.”
- T1219Remote Access Tools
“Attackers escalated privileges, established persistence via legitimate remote access tools, and in the most advanced case deployed DragonForce ransomware, resulting in environment-wide encryption.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
20 reports, newest first · the exact sentence from each-
NSO Spyware Pegasus Hit a Serbian University Rector Six Days Before Snap Elections“NSO Spyware Pegasus Hit a Serbian University Rector Six Days Before Snap Elections”
-
Risky Bulletin: Hacker hijacks 10% of Tor exit nodes“… sided with NSO Group and ruled that Meta failed to sufficiently prove that the Israeli spyware maker defied a court order and used its Pegasus spyware to hack new WhatsApp accounts.”
-
Pegasus Spyware Infection Confirmed on Serbian University Rector's iPhone Days Before Election“Pegasus Spyware Infection Confirmed on Serbian University Rector's iPhone Days Before Election”
-
Two more Serbian opposition figures targeted with spyware, researchers say“A phone belonging to the rector of the University of Belgrade was discovered to have been infected with Pegasus spyware, the latest in a series of such discoveries in the lead-up to Serbia's national elections.”
-
Spyware found on devices belonging to prominent Serbian critics as elections loom“That wave included 14 people, among them a member of parliament and a local government official, targeted with Pegasus and a new version of the NoviSpy Android spyware.”
-
Citizen Lab Traces Zero-Click Candiru Spyware Infections at Al Jazeera to Targeted Online Ads“In 2020, dozens of its journalists' iPhones were hacked with NSO Group's Pegasus spyware, in a different operation that used a different method.”
-
Risky Bulletin: Spyware chip found in Ledger crypto-wallets“Poland's Pegasus data was sent abroad: A Polish government investigation has found that data collected through the Pegasus spyware by a previous administration was allowed to be sent abroad, outside government control, in a major national security lapse.”
-
Judge dismisses spyware case brought by Salvadoran journalists targeted with Pegasus“Judge dismisses spyware case brought by Salvadoran journalists targeted with Pegasus”
-
Cyber Brief 26-10 - September 2026“Serbian pro-democracy movement members targeted with Pegasus and NoviSpy spyware”
-
Risky Bulletin: Authorities dismantle KillSec group, arrest members across Europe“Morocco used telecoms to deploy spyware: The Moroccan government used the state-owned Maroc Telecom network to deploy the Pegasus spyware against human rights defenders.”
-
Risky Bulletin: Sanctions force CAs to revoke TLS certs in Iran, Russia“…acks: Former MEP Stelios Kouloglou has sued four executives from Israeli spyware maker NSO Group over the hacking of his phone with the Pegasus spyware.”
-
Cyber Brief 26-08 - July 2026“…lick phishing campaigns against organisations using Zimbra webmail, while journalists reported that Morocco’s intelligence service used Pegasus spyware to target European politicians and journalists.”
-
Risky Bulletin: BEC campaign steals €35 million from French notaries“Multiple reports have blamed the government of using NoviSpy and Pegasus spyware against student protesters, journalists, and political activists.”
-
Risky Bulletin: Russia tells data centers to deploy drone defenses“Their devices were infected with the NoviSpy or Pegasus spyware families.”
-
Pegasus Zero-Click Exploit Infects Serbian Student Activist's iPhone“Pegasus Zero-Click Exploit Infects Serbian Student Activist's iPhone”
-
ADINT: From Ad-Based Geolocation Tracking to Intrusion Vector“… researching and leveraging vulnerabilities on WhatsApp messaging service, used as a zero-click intrusion vector to install the spyware Pegasus.”
-
Predators for Hire: Commercial Surveillance Vendors Overview“The Project Pegasus (2021), for instance, revealed that the NSO Group's Pegasus spyware was used in countries like Saudi Arabia, India, Mexico, Morocco, and Hungary - often without legal oversight.”
-
GoldPickaxe exposed: How Group-IB analyzed the face-stealing iOS Trojan and how to do it yourself“In our recent article, Group-IB experts discussed how to detect sophisticated spyware like Pegasus, which is often used by advanced threat actors and state-sponsored groups to execute zero-click exploits, affecting zero-day vulnerabilities, and gain full remote control of devices…”
-
LightSpy Malware Variant Targeting macOS“…cle, About Apple threat notifications and protecting against mercenary spyware, Apple is referring to the more recent and sophisticated Pegasus spyware from NSO Group.”
-
In-Depth Analysis of Pegasus Spyware and How To Detect It on Your Mobile Devices“In-Depth Analysis of Pegasus Spyware and How To Detect It on Your Mobile Devices”
Indicators in its reports
named in the reports above- cert[.]lvin 1 report
- idscan[.]netin 1 report
- collusion[.]wikiin 1 report
- gov[.]ukin 1 report
- surveillancewatch[.]ioin 1 report
- afd03337d1500d6a…df26786ea4a4in 1 report
- irc[.]pidin 1 report
- 0f66a4daba647486…f8a562bc306cin 1 report
- hxxps://blogs.blackberry[.]com/en/2024/04/lightspy-returns-renewed-espionage-campaign-targets-southern-asia-possibly-indiain 1 report
- hxxps://www.threatfabric[.]com/blogs/lightspy-mapt-mobile-payment-system-attackin 1 report
- www.threatfabric[.]comin 1 report
Copy these 11 indicators · defanged
Thanks — we review every report.