Mobile spyware represents the dominant surveillance threat against high-value individuals in 2026. This intelligence analysis covers the full spectrum of mobile surveillance tools — from NSO Group's Pegasus to Predator, Hermit, and emerging platforms — and the defensive strategies that can reduce exposure.
The commercial mobile spyware industry extends far beyond Pegasus and NSO Group. A multi-billion dollar market has developed around the sale of mobile surveillance capabilities to government clients, with dozens of vendors offering varying levels of capability, targeting range, and operational security.
NSO Group is the most documented mobile spyware vendor, but it is not the only one. Intellexa (developer of Predator) operates across Europe and the Middle East. QuaDream (developer of Reign) was an Israeli firm that dissolved in 2023 under exposure pressure but whose technology reportedly transferred to other entities. Paragon Solutions (developer of Graphite) targets encrypted messaging applications. RCS Lab (developer of Hermit) has been documented targeting Italian and Kazakh citizens.
Predator, developed by the Intellexa consortium, represents the most capable known alternative to Pegasus. Like Pegasus, Predator has demonstrated zero-click infection capabilities and comprehensive device access. Investigations by Citizen Lab and Access Now have documented Predator deployment against opposition politicians, journalists, and activists across Europe, the Middle East, and South Asia.
Both Android and iOS platforms have been successfully targeted by commercial spyware. iOS has been the historically preferred target because its uniformity — all iOS devices run essentially the same software — means a single zero-day vulnerability can be exploited against all users simultaneously. Android fragmentation means more research is required to achieve broad exploitation, but documented Android Pegasus infections demonstrate the capability exists.
Commercial spyware vendors rely on a steady supply of zero-day vulnerabilities — previously unknown security flaws that manufacturers have not yet patched. These vulnerabilities are acquired through internal research teams, purchased from independent vulnerability researchers, or sourced from specialist brokers. A single zero-click iOS zero-day chain can command multi-million dollar prices in private markets.
Beyond device-level spyware, mobile surveillance includes network-level interception through IMSI catchers (false cell towers) that intercept voice calls and SMS messages. While less sophisticated than Pegasus, these tools are widely deployed by law enforcement and intelligence agencies globally and represent a significant threat in locations where such equipment is present.
Operational standards that govern every engagement we undertake
Valukoja 8,
11415 Tallinn, Estonia