They reveal scandalous spy case against journalists, politicians and activists around the world

Israeli group NSO and its malware Pegasus have been in the news since at least 2016, when investigators accused it of helping spy on a dissident in the United Arab Emirates.

The scope of use of Pegasus was reported by The Washington Post, The Guardian, Le Monde and other media that they collaborated in a data breach investigation.

The leak concerns more than 50,000 smartphone numbers that have been identified as belonging to people of concern by NSO customers since 2016, according to the publications.

The Post noted that the list was shared with the media by Forbidden Stories, a Paris-based nonprofit journalistic organization, and Amnesty International. The newspaper said the total number of phones attacked or monitored was unknown.

The list includes numbers of media journalists from around the world, such as Agence France-Presse, The Wall Street Journal, CNN, The New York Times, Al Jazeera, France 24, Radio Free Europe, Mediapart, El País, Associated Press, Le Monde, Bloomberg, The Economist, Reuters and Voice of America, The Guardian reported.

The Post said 15,000 of the phone numbers were in Mexico and included those of politicians, labor leaders, journalists and government critics.

The list includes the number of a Mexican freelance journalist who was later killed in a car wash. His phone has never been found and it is not known if it was hacked.

Moroccan security services used spyware to attack around 30 French journalists and media executives, according to the investigation.

The use of the software to hack the phones of Al-Jazeera reporters and a Moroccan journalist had previously been reported by Citizen Lab, a research center at the University of Toronto, and Amnesty International.

Also listed are two issues belonging to women close to Saudi-born journalist Jamal Khashoggi, who was killed by a Saudi squad in 2018.

The Post said the numbers on the list are not being assigned, but media involved in the project have been able to identify more than 1,000 people from more than 50 countries.

Among them were several members of Arab royal families, at least 65 business executives, 85 human rights activists, 189 journalists and more than 600 politicians and government officials, including heads of state and government and ministers.

According to reports, many numbers on the list were concentrated in 10 countries: Azerbaijan, Bahrain, Hungary, India, Kazakhstan, Mexico, Morocco, Rwanda, Saudi Arabia and the United Arab Emirates.

Pegasus, according to research notes, is a highly invasive tool that can turn on a target person’s phone camera and microphone, as well as access data on the device, effectively turning a phone into a pocket spy.

In some cases, it can be installed without prompting the user to download.

In a statement released on Sunday, NSO said the Forbidden Stories report is “filled with flawed assumptions and unfounded theories,” and threatened to sue the organization for libel.

“As NSO has previously stated, our technology is in no way related to the heinous murder of Jamal Khashoggi,” the company said.

“We would like to point out that NSO sells its technologies only to law enforcement and intelligence agencies of certain governments for the sole purpose of saving lives by preventing crime and terrorist acts,” he noted.

Citizen Lab reported in December that the mobile devices of more than three dozen journalists from the Qatari Al-Jazeera network had been attacked by Pegasus.

Amnesty International reported in June last year that Moroccan authorities used NSO malware to insert spyware into the mobile phone of Omar Radi, a journalist convicted of a social media article.

At the time, NSO told AFP it was “deeply concerned about the allegations” and was reviewing the information.

Founded in 2010 by Israelis Shalev Hulio and Omri Lavie, NSO is based in Israel’s high-tech hub in Herzliya, near Tel Aviv, and claims it employs hundreds of people in Israel and around the world.