Pegasus Spyware: A Global Threat to Security and Rights

By Deji Saliu
July 23, 2026

Pegasus is a powerful mobile spyware suite developed by the Israeli company NSO Group. It can infiltrate smartphones silently, often without any action from the user. First discovered in the wild around 2016, Pegasus uses zero-day vulnerabilities to exploit mobile operating systems like iOS and Android. Once installed, the spyware gives its operator full access to the device, including text messages, emails, photos, passwords, microphone, camera, and location data.

NSO Group claims Pegasus is sold only to vetted government agencies for lawful purposes such as fighting terrorism and serious crime. However, investigations have revealed that the tool has also been deployed against journalists, human rights defenders, political opposition figures, and civil society actors around the world.

lock, security, secure, padlock, padlock, padlock, padlock, padlock, padlock

Global Deployment and Controversy

In 2021, an international collaboration of journalists revealed that tens of thousands of phone numbers were potential Pegasus targets. The list included heads of state, political dissidents, business executives, and activists. Some countries used the spyware to monitor both foreign and domestic targets, leading to widespread condemnation and concerns over diplomatic abuse.

Countries in Africa, the Middle East, Asia, and Latin America were found to have either acquired or been targeted with Pegasus. European Union institutions initiated investigations, while technology companies such as Apple and Meta filed lawsuits against NSO Group. The United States placed NSO Group on a trade blacklist, citing national security concerns.

The use of Pegasus has demonstrated how spyware developed for intelligence purposes can be misused to suppress dissent and monitor critics of those in power.

Human Rights and Surveillance Concerns

Pegasus raises serious human rights concerns. It bypasses encryption by accessing data directly from the infected device, rendering secure messaging apps and email protections ineffective. Its stealthy nature means most victims remain unaware of the breach, leaving them vulnerable for prolonged periods.

The chilling effect on free speech, press freedom, and political participation is substantial. Journalists may fear exposing sources. Activists might avoid organising protests. Political opposition could be compromised or blackmailed. This undermines democratic institutions and the rule of law.

Once a government or agency gains access to such tools, the temptation to use them beyond their intended scope becomes significant, especially in environments where legal and institutional checks are weak or absent.

The Nigerian Context

While Nigeria has not been officially confirmed as a Pegasus client, the country’s growing surveillance capacity presents similar concerns. Multiple investigations show that Nigerian security services have acquired sophisticated interception technologies. These include mobile network monitoring systems, biometric databases, and citywide CCTV surveillance projects.

In some cases, governors and agencies have allegedly used such tools without judicial oversight to monitor political opponents or suppress dissent. Civil society groups have raised alarms over the arrest and harassment of activists, journalists, and social media users. Reports also indicate that surveillance tools from firms like Circles, a company linked to NSO Group, have been deployed in Nigeria.

With rising investments in digital security infrastructure and few transparency mechanisms, there is a risk that Pegasus or similar spyware could be introduced or already used in Nigerian cyberspace. This poses challenges for human rights, press freedom, and civic engagement.

Challenges for Cybersecurity

Pegasus and similar tools bypass traditional cybersecurity models. Antivirus solutions and endpoint protection systems are often ineffective against zero-click infections that leave no visible trace. These attacks exploit unknown vulnerabilities in messaging apps or the operating system kernel, and once successful, grant root-level access.

Even strong encryption cannot protect data when the device itself is compromised. Security professionals must now consider that mobile devices, especially those used by high-profile individuals, can be compromised at the hardware and firmware level. This forces a shift in security posture, from perimeter defence to threat detection and forensic investigation.

Organisations should consider deploying hardened mobile operating systems, enforcing strict update policies, and limiting sensitive communications on vulnerable devices. Threat intelligence sharing and global collaboration are crucial to identify and mitigate these risks.

Legal and Policy Recommendations

Governments must establish robust legal frameworks that clearly define and limit the use of surveillance tools like Pegasus. Such frameworks should mandate independent judicial authorisation, transparent oversight, and effective remedies for misuse.

In countries like Nigeria, where surveillance powers are expanding, laws should ensure that technology is not deployed against political opponents, journalists, or citizens engaged in lawful expression. Data protection laws must be strengthened and enforced. Institutional checks should be put in place to monitor procurement and deployment of surveillance technologies.

At the global level, there is a growing call for an international moratorium on the sale and use of spyware until clear human rights–compliant regulations are adopted. Export controls, transparency measures, and global accountability mechanisms are necessary to prevent abuse.

Technical Safeguards for Individuals and Organisations

For individuals and activists:

Keep mobile devices updated with the latest operating system patches
Avoid clicking on unknown links or downloading suspicious files
Use security-focused apps and devices where possible
Consider using separate devices for sensitive communications
Seek digital security training from trusted civil society organisations

For organisations and governments:

Deploy mobile device management (MDM) to enforce strict configurations
Monitor network traffic for anomalies associated with spyware
Train security teams in advanced mobile forensics
Create secure channels for whistleblowers and victims to report concerns
Work with civil society to promote transparency and oversight

Conclusion

Pegasus represents more than a cybersecurity challenge. It is a test of global governance, ethical restraint, and democratic accountability. Left unchecked, spyware undermines trust in digital systems, weakens fundamental rights, and destabilises democratic institutions. Governments and institutions must act with urgency to regulate the use and support victims of its abuse. Nigeria, like many countries navigating digital transformation and national security threats, must ensure that the pursuit of security does not come at the expense of civil liberties and constitutional rights.