Pegasus Spyware 2026 | New Citizen Lab Report on iPhone Zero-Click Exploits

Pegasus spyware remains the most sophisticated mercenary surveillance tool available on the commercial market, and a new zero-click exploit chain discovered by Citizen Lab proves that NSO Group has adapted to Apple's hardening measures. The exploit targets the ImageIO framework in iOS 18, the same image parsing library that has been the source of multiple prior vulnerabilities. By sending a crafted image file through iMessage, the attacker achieves Remote Code Execution (RCE) on a fully patched device without the target ever opening a message or tapping a notification.

Background | The Spyware Arms Race After the Entity List

NSO Group was placed on the U.S. Department of Commerce Entity List in November 2021, which barred American companies from providing software, technology, or components to the Israeli firm. Despite this designation, the company continued to develop and sell Pegasus to government clients, according to documents filed in the ongoing WhatsApp lawsuit. The company reportedly restructured its licensing model in 2024, moving from direct software sales to a 'counterterrorism and crime prevention' subscription service that provides access to the Pegasus platform without transferring the underlying code.

The new exploit chain represents a significant escalation because it bypasses Apple's Lockdown Mode, a feature introduced in iOS 16 that was specifically designed to protect high-risk users from mercenary spyware. Citizen Lab's report indicates that the attack uses a heap overflow in the ImageIO HEIC decoder, combined with a type confusion in the kernel extension that handles message attachment previews. Citizen Lab's full technical report includes the Indicators of Compromise and vulnerability chain analysis.

The Core Finding | Lockdown Mode Evasion and the HEIC Attack Vector

Citizen Lab's analysis reveals that the Pegasus exploit chain uses three distinct vulnerabilities chained together. The first is a use-after-free in the HEIC (High Efficiency Image Codec) decoder within ImageIO, the second is a type confusion in the UserNotifications framework that handles incoming message previews, and the third is a kernel memory corruption in com.apple.securityd that allows the exploit to disable SIP (System Integrity Protection). This three-stage chain allows Pegasus to execute payload at the kernel level without triggering any of Apple's security heuristics.

The most concerning finding is that the exploit operates even when Lockdown Mode is enabled. Lockdown Mode works by disabling certain attack surface features, including link previews and complex media processing. However, the ImageIO parser is an exception, because it must still process images for accessibility features like VoiceOver. The exploit abuses this exception, using VoiceOver's image description generation as an alternative execution path when the primary preview mechanism is disabled. Amnesty International's forensic analysis of infected devices confirmed that the Pegasus payload was running in kernel memory with SIP disabled, despite Lockdown Mode being active at the time of infection. Amnesty International's forensics report provides device-level analysis.

The Implications | Mercenary Spyware as a Global Intelligence Service

The persistence of NSO Group's capabilities despite international sanctions reveals a fundamental gap in how the world regulates mercenary spyware. Unlike arms exports, which require government licenses and are subject to end-use monitoring, spyware can be developed in one country, hosted on cloud infrastructure in a second country, and deployed against targets in a third country. The U.S. Commerce Department's Entity List designation has not stopped NSO Group from operating because the company sources its server infrastructure through intermediaries in Cyprus and the United Arab Emirates.

The targets in this particular campaign were two Mexican journalists who had reported on cartel corruption involving municipal police forces. The timing of the infection correlates with the publication of a series of investigative articles in early May 2026. This pattern matches the wider threat landscape documented by the broader surveillance technology ecosystem. Citizen Lab has linked the same Pegasus infrastructure to infections of human rights lawyers in Hungary and political activists in Thailand.

What Comes Next | The WhatsApp Lawsuit and Potential Remedies

The WhatsApp lawsuit against NSO Group, filed in 2019, has entered the discovery phase. A federal judge in California ruled that NSO Group cannot claim sovereign immunity because the company's tools are used by governments but are developed and sold as a commercial product. The discovery process has already yielded internal NSO Group documents showing that the company knew about vulnerabilities in its exploit chains and continued to sell them to clients without disclosing the flaws to Apple or Google.

Apple has responded by establishing a dedicated Mercenary Spyware Response Team within its Security Engineering and Architecture (SEAR) group. The team is tasked with reverse engineering any Pegasus variant discovered in the wild within 72 hours and deploying a mitigative patch within two weeks. However, the fundamental architectural challenge remains: as long as iOS needs to process untrusted data from untrusted sources iMessage being the most obvious vector there will always be new exploit surfaces for NSO Group's researchers to discover.

Frequently Asked Questions