Skip to main content

NSO has carried out 'unlawful' surveillance to target Amnesty staff members, HRDs


Counterview Desk
Following the exposure that Israeli spyware Pegasus, manufactured by NSO Group, has been used as a surveillance tool on smartphones used by about 1,500 human rights defenders (HRDs), journalists and activists, including in India, the top rights body, Amnesty International India, has appealed to those who have received a notification immediately to get in touch with Amnesty Tech at share@amnesty.tech for support.
An Amnesty release on November 2 said that the rights body could also be contacted “on Signal or WhatsApp at +44 7492 882216”, adding, “We would be keen to provide support to HRDs, who have been targeted, to ensure they take defensive security measures immediately, as well as to understand more about the attacks and investigate possible infections.”
Meanwhile, Amnesty has put out questions and answers for HRDs, activist, or journalist based in India to understand NSO Group’s spyware Pegasus especially the WhatsApp targeting.

Text:

Q: What do we know about the NSO Group and its ‘Pegasus’ Spyware?
A: ‘NSO Group’ is an Israeli spyware manufacturer that claims to sell its surveillance tools – the most well-known being its Pegasus spyware – exclusively to governments and government agencies ‘to combat terror and crime’.
Its products have been misused multiple times to conduct unlawful surveillance against human rights defenders. In the past, it has been used to target an Amnesty International staff member, HRDs, activists, and journalists from Saudi Arabia, UAE, Mexico, Morocco, and Rwanda.
Q: How does Pegasus work?
A: If infected by the Pegasus spyware, the user’s Smartphone is compromised. It can track keystrokes, take control of the phone’s camera and microphone, and access contact lists and encrypted messages.
Until now, Pegasus is known to be delivered through SMS messages carrying malicious links and through exploiting a zero-day vulnerability on WhatsApp. In the latter, intrusive spyware could be delivered on to the target’s mobile device without the targeted person having to click on a malicious link. The targeted person would simply see a missed call on WhatsApp.
In addition to this, Amnesty International has also found evidence of network injection attacks that could also be attributed to NSO Group. Network injection attacks are generally called “man-in-the-middle” attacks. Through this, an attacker with access to a target’s mobile network connection can monitor and opportunistically hijack web traffic and silently re-route the web browser to malicious exploit pages.
Q: How did the targeting via WhatsApp work?
A: NSO Group exploited a security vulnerability in WhatsApp until May 2019. In order to exploit this, the digital attack initiated WhatsApp calls to the target’s device. Attackers may have tried to exploit this issue by making calls multiple times during the night when the target was likely to be asleep and not notice these calls. Successful infection of the target’s device may result in the app crashing. There is a possibility that the attacker may also remotely erase evidence of these calls from the device’s call logs. Evidence of failed attacks may appear as missed calls from unknown numbers in your WhatsApp call log.
Q: If I didn’t receive a notification from WhatsApp, does this mean I wasn’t targeted by NSO Group’s tools?
A: NSO Group’s Pegasus tool is used for targeted attacks and by design, is not meant for mass surveillance. This means that only select individuals would have been targeted. However, if you are a high risk user, i.e., an activist, journalist, or HRD involved in politically sensitive activism, you cannot presume that you have not been targeted simply because you haven’t received a notification from WhatsApp.
The attack was delivered by exploiting a vulnerability in WhatsApp. However, NSO Pegasus infections can also be delivered through other means. Based on information revealed by our own investigations, an Amnesty International staffer was targeted using SMS messages. One HRD in Morocco was targeted both before and after the attacks using the WhatsApp exploit, but not with the WhatsApp exploit itself. Both of them were targeted using SMS messages containing malicious links and network injection attacks that could also be attributed to NSO Group’s tools. This indicates that NSO Group has the documented capability to deliver infections through means other than WhatsApp.
Q: If WhatsApp was targeted, can’t I just switch to another encrypted platform?
A: No. A vulnerability in the WhatsApp software was exploited to deliver the spyware. All complex software can have these types of vulnerabilities. This vulnerability was not a flaw in WhatsApp’s end-to-end encryption protocol.
This also does not mean that only the Whatsapp data of the target was compromised. If the attack attempt was successful, the spyware would gain full access to the device. Any other data on the device including encrypted platforms such as Signal or Telegram could then also have been accessed.
Q: Can Pegasus plant data into my devices?
A: Based on publicly available information, planting data is not a feature of NSO Group’s Pegasus spyware.
Q: What steps can I take to protect myself?
A: None of the security best practices offer complete and foolproof protection. However, it is a good practice to install the latest software updates of operating systems and encrypted messaging applications on your mobile device.
Pegasus remains a relatively uncommon threat and standard digital hygiene steps are still important. Keep your devices software up-to-date. Use a unique password for each service that you use and store these passwords in a secure password manager. Enable two-factor authentication on all accounts where it is available.

Comments

Post a Comment

TRENDING

Beyond India-China borders: Economic links expand, political gaps persist

By Bhabani Shankar Nayak*  Despite growing trade between India and China, a persistent trust deficit continues to shape their bilateral relationship. Expanding economic engagement has not fully resolved political differences, many of which stem from historical legacies as well as contemporary geopolitical concerns. Border disputes—often traced to colonial-era arrangements—remain a significant obstacle to deeper cooperation, while differing strategic alignments in global affairs add further complexity.
Post a Comment
»

GreenTech Summit claims NCR as key green building hub, without pan-India comparison

By A Representative   The Indian Green Building Council (IGBC), under the Confederation of Indian Industry, held its GreenTech Summit 2026 in New Delhi, where industry representatives, policymakers and sustainability professionals discussed the adoption of climate technologies in India’s built environment.
Post a Comment
»

Gujarat cadre to HDFC: When bureaucratic style hits corporate walls

By Rajiv Shah   I was a little amused by the abrupt March 17, 2026 resignation of Atanu Chakraborty —a Gujarat cadre IAS officer of the 1985 batch who retired from the government in 2020—as chairman of HDFC Bank . Much of what may have led to his decision to quit this ostensibly high post—actually a non-executive, part-time role—is by now well known. I followed most of it online with considerable interest, partly because I had interacted with him umpteen times during my stint as The Times of India correspondent in Gandhinagar from 1997 to 2012.
6 comments
»

Operation Epic Fury: Making America great at the world’s expense?

By N.S. Venkataraman*  ​The decades-long enmity between Iran and Israel is well-documented, but historically, their direct confrontations have been brief, constrained by the logistical and economic limitations of sustained warfare. The current conflict in the Middle East, however, marks a radical and dangerous departure from this pattern. 
Post a Comment
»

Buddhist shrines were 'massively destroyed' by Brahmanical rulers: Historian DN Jha

Nalanda mahavihara By Rajiv Shah  Prominent historian DN Jha, an expert in India's ancient and medieval past, in his new book , "Against the Grain: Notes on Identity, Intolerance and History", in a sharp critique of "Hindutva ideologues", who look at the ancient period of Indian history as "a golden age marked by social harmony, devoid of any religious violence", has said, "Demolition and desecration of rival religious establishments, and the appropriation of their idols, was not uncommon in India before the advent of Islam".
51 comments
»

Swami Vivekananda's views on caste and sexuality were 'painfully' regressive

By Bhaskar Sur* Swami Vivekananda now belongs more to the modern Hindu mythology than reality. It makes a daunting job to discover the real human being who knew unemployment, humiliation of losing a teaching job for 'incompetence', longed in vain for the bliss of a happy conjugal life only to suffer the consequent frustration.
59 comments
»

India has been getting its economic growth wrong for two decades, say top economists

By Jag Jivan*   India's official GDP figures have misrepresented the trajectory of the world's fifth-largest economy for the better part of two decades, according to a major new working paper published by the Peterson Institute for International Economics (PIIE). It finds that India overstated annual growth by up to two percentage points after 2011 — and understated it during the boom years of the 2000s.
Post a Comment
»

'Tax the top': Nationwide protests demand action as 1% control 40% of India’s wealth

By A Representative   Civil rights groups across the country observed the martyrdom day of Bhagat Singh on March 23, as people from diverse backgrounds united to raise their voices against growing economic inequality. The mobilisations marked the launch of a nationwide campaign against inequality, running from March 23 to April 14 (Ambedkar Jayanti), under the banner of the “Tax The Top” campaign.
Post a Comment
»

Beyond the election manifesto: Why climate is now a kitchen table issue

By Vikas Meshram*  March has long been a month of gentle transition, the period when winter softly retreats and a mild warmth signals nature’s renewal. Yet, in recent years, this dependable rhythm has been disrupted. This year, since the beginning of March, temperatures across vast swathes of the country have shattered previous records, soaring to between 35 and 40 degrees Celsius in some regions. This is not a mere fluctuation in the weather; it is a serious and alarming indicator of climate change .
Post a Comment
»