The Spanish government on Monday announced during a press conference that the phones of Prime Minister Pedro Sánchez and Defence Minister Margarita Robles were both infected by the infamous Pegasus spyware last year — reports The Guardian.
Developed by Israeli surveillance and cyberintelligence company NSO Group, Pegasus is capable of accessing, taking over, and extracting sensitive information from a smartphone without the user ever knowing.
Pegasus can even be used to hack into an iPhone, despite Apple’s oft-touted superior privacy and security measures. The spyware can also be administered as a zero-click exploit without the user doing anything to enable the infiltration.
Prime Minister Sánchez’s phone was targeted in May and June 2021 while Robles’s was targeted in June 2021, Félix Bolaños, the minister for the presidency, revealed during the press conference. The perpetrators managed to extract data from both devices.
NSO Group maintains that Pegasus is only sold to governments and state agencies to track criminals and terrorists.
Bolaños said the “illicit” and “external” targeting would be investigated by Spain’s highest criminal court, the Audiencia Nacional. He added that the government believes the hack originated from abroad, noting that any such monitoring from within Spain would have required judicial authorization.
“These facts have been confirmed and are irrefutable,” said Bolaños. “I don’t think now is the time to engage in supposition or conjecture about what the motivation may have been.”
The supposed hack was made public only a couple of weeks after reports surfaced alleging the Spanish government used Pegasus to monitor dozens of members of the Catalan independence movement, including Catalonia’s President, Pere Aragonès.
NSO Group said in a statement it would investigate “any suspicion of misuse” of its software, adding that it would cooperate with any governmental investigation.
“While we have not seen any information related to this alleged misuse and we are not familiar with the details of this specific case, NSO’s firm stance on these issues is that the use of cyber tools in order to monitor politicians, dissidents, activists and journalists is a severe misuse of any technology and goes against the desired use of such critical tools,” a spokesperson said.
“NSO is a software provider; the company does not operate the technology nor is privy to the collected data. The company does not and cannot know who the targets of its customers are, yet implements measures to ensure that these systems are used solely for the authorised uses.”
Pegasus has previously been used to target iPhones belonging to Bahraini activists, The New York Times journalist Ben Hubbard, and the wife of murdered Saudi journalist Jamal Khashoggi. The Spanish government did not specify Sánchez’s smartphone, but Pegasus is well known to be able to hack Apple’s iPhone.