Pegasus: How a Spy in Your Pocket Threatens the End of Privacy, Dignity, and Democracy

by Laurent Richard

The Security Lab duo made an even more remarkable discovery in the forensic image of Maati’s phone. When Claudio and Donncha combed through the Safari browsing history database and its Session Resource logs, they began to note and then reconstruct certain strange digital detours they were seeing. While trying to determine if Maati’s phone had opened any known Pegasus links, they discovered that the phone (having already been subjected to eighteen months of Pegasus’s standard SMS message attack) was navigating to strange and previously unknown websites in the spring and summer of 2019. Claudio and Donncha weren’t sure just what they were seeing in the databases, but it “looked suspicious,” Donncha says, “and the timing was right.” When Maati had tried to make a routine visit to the Yahoo home page one day in July 2019, for instance, he was redirected, in less than three milliseconds, to a suspicious-looking web page named Free247downloads.com at https://bun54l2b67.get1tn0w.free247downloads[.]com:30495/szev4hz. Seconds later, Free247downloads dropped a bomb of malicious code into the phone without anything to alert Maati that something out of the ordinary might have happened.