Commercial Spyware Guide: Mercenary Spyware Defence

Commercial spyware, often called mercenary spyware, gives its government customers full, covert access to a target's phone, and the people it is aimed at rarely know until a platform vendor or a forensic lab tells them. Products such as NSO Group's Pegasus, Intellexa's Predator and Paragon's Graphite are sold as complete surveillance services, delivered through exploit chains that often need no click at all. The targets are a small population: journalists, activists, lawyers, politicians, diplomats and the executives and staff around sensitive negotiations. This guide explains how the threat works at a defensive level, who is exposed, how compromise is detected and what organisations can do to protect high-risk users. It is written for security teams, executive protection leads and mobile administrators. For commodity mobile threats such as banking trojans and stalkerware, see the Mobile Malware Guide.

Key takeaways

The threat is targeted, not mass. Apple describes mercenary spyware attacks as costly and aimed at a very small number of individuals, so protection is a programme for named high-risk users rather than a fleet-wide control.
Zero-click delivery removes user error from the equation. Documented chains in iMessage, WhatsApp and image parsers compromised fully patched-at-the-time devices without any interaction, so awareness training alone cannot stop them.
Hardening modes are the strongest available control. Apple Lockdown Mode and Android Advanced Protection cut the attack surface that exploit chains depend on, and Citizen Lab and Apple believe Lockdown Mode blocked the BLASTPASS Pegasus chain.
Threat notifications are an incident trigger. Apple, Google, Meta and WhatsApp notifications should start a defined response with expert forensic support, not an IT ticket.
Policy pressure is rising but vendors adapt. US Executive Order 14093, Entity List and Treasury sanctions and the Pall Mall Process Code of Practice raise costs, yet leaked material reported in December 2025 indicated Predator was still reaching new targets.

How the attack works

A commercial spyware operation is a supply chain: a vendor develops or buys exploits, packages them with an implant and a command infrastructure, and sells access to a government customer that chooses the targets. The defender sees only the last stage, the device compromise. The stages below are described at the level needed to choose controls; no exploitation detail is given.

Stage	What happens	ATT&CK (Mobile) reference	Defensive lever
Targeting	Customer selects a person, often identified by phone number or messaging account	Outside the device	Limit exposure of personal numbers; separate devices for sensitive roles
Initial access, zero-click	Malformed content parsed automatically by a messaging app or media library	T1664 Exploitation for Initial Access	Lockdown Mode, Advanced Protection, rapid patching
Initial access, one-click	One-time link sent by SMS or messaging app, or a targeted advert or network injection redirect	T1456 Drive-By Compromise	Hardened browser settings, link scepticism, ad blocking
Execution and escalation	Browser or app code execution followed by a kernel exploit	T1658 Exploitation for Client Execution; T1404 Exploitation for Privilege Escalation	Patch to the newest OS; memory tagging where supported
Collection	Messages, location, microphone, camera and stored files read, bypassing end-to-end encryption on the device	T1636.004 SMS Messages; T1430 Location Tracking; T1429 Audio Capture; T1512 Video Capture; T1533 Data from Local System	Limit data held on the device; compartmentalise
Exfiltration	Data sent over the implant's command channel	T1437 Application Layer Protocol; T1646 Exfiltration Over C2 Channel	Network indicators from published research; DNS logging

Two features make this class distinctive. First, end-to-end encryption does not help once the endpoint is owned: the implant reads messages after decryption. Second, many implants are designed to be non-persistent and to remove themselves, which limits what forensics can recover and makes early capture of logs important. MITRE ATT&CK tracks one family directly as S0316 Pegasus for Android.

Documented delivery chains

BLASTPASS (September 2023): Citizen Lab found a zero-click Pegasus chain on an iPhone running iOS 16.6 belonging to an employee of a Washington DC civil society organisation, delivered as malicious images in PassKit attachments over iMessage. Apple issued CVE-2023-41064 and CVE-2023-41061, both in the CISA Known Exploited Vulnerabilities (KEV) catalogue.
Graphite (June 2025): Citizen Lab reported with high confidence that Paragon's Graphite compromised a European journalist's iPhone on iOS 18.2.1 through an iMessage zero-click attack, fixed as of iOS 18.3.1 and tracked as CVE-2025-43200 (KEV, added 16 June 2025). Apple had sent threat notifications on 29 April 2025.
WhatsApp chain (August 2025): WhatsApp fixed CVE-2025-55177 in its iOS and Mac apps; it was chained with Apple's CVE-2025-43300. Meta said it sent fewer than 200 notifications, and Amnesty International's Security Lab described a zero-click campaign running for about 90 days. Both CVEs are in KEV.
LANDFALL (November 2025): Palo Alto Networks Unit 42 described Android spyware for Samsung Galaxy devices delivered in malformed DNG image files, exploiting CVE-2025-21042 (patched April 2025, KEV since 10 November 2025). Unit 42 has not attributed it to a vendor.
Advert-based delivery: reporting on leaked Intellexa material in December 2025 described a system, called Aladdin, that uses mobile advertising to reach and infect targeted devices without a click. Treat this as reported, not independently confirmed.

Where it shows up

Apple says it has sent threat notifications several times a year since 2021 and has notified users in more than 150 countries. Google Threat Intelligence Group (GTIG) counted 90 zero-days exploited in the wild in 2025 and, as reported in March 2026, attributed more of them to commercial surveillance vendors than to state espionage groups, with vendors concentrating on mobile devices and browsers.

Population	Why targeted	Typical organisational owner
Journalists and editors	Sources, unpublished investigations	Newsroom security or digital safety team
Civil society, human rights and legal staff	Contacts, case files, travel	Operations or a helpline partner such as Access Now
Politicians, officials, diplomats	Policy positions, negotiations	Government security or parliamentary IT
Executives in M&A, energy, defence or sanctioned markets	Deal terms, government relations	CISO with the executive protection or physical security lead
Family members and assistants of the above	Indirect access to the principal	Often nobody: include them explicitly

Impact

Total confidentiality loss on the device: encrypted chats, email, photos, contacts, call history and location, plus live microphone and camera access where the implant supports it, as Unit 42 found in LANDFALL's code.
Exposure of third parties: sources, clients, colleagues and negotiating counterparts are compromised along with the target.
Credential and session exposure: tokens, passkeys used on the device and authenticator apps can give access to corporate SaaS and email. Treat corporate sessions on a compromised phone as stolen.
Legal and regulatory consequences: personal data of others is exposed, which may trigger breach assessment under data protection law, and privileged legal material may be lost.
Chilling effect: the stated purpose of much of this surveillance is to deter reporting and advocacy, so the human impact outlasts the technical incident.

Detection

Most organisations cannot detect mercenary spyware with their own tools. Detection comes from platform vendors, specialist labs and a small number of forensic indicators, so the practical goal is fast, well-run escalation.

Signal	Source	Response
Apple threat notification	Lock Screen and Settings alert, email from [email protected], banner at account.apple.com	Verify only by signing in at account.apple.com; never through links in the message. Enable Lockdown Mode and get expert help
Meta, WhatsApp or Google warning	In-app or account notification	Same response; record the time and content of the notice
Forensic indicators of compromise	Published by Citizen Lab, Amnesty and vendors; checked with the Mobile Verification Toolkit (MVT)	Consensual analysis of a backup, sysdiagnose or Android intrusion log by trained staff or a partner lab
Network indicators	Published infrastructure from research reports	Match against DNS and proxy logs for managed devices
Intrusion logs	Android Advanced Protection optional Intrusion Logging, stored end-to-end encrypted in the cloud	Enable in advance for high-risk users so evidence exists when needed

Preserve before you wipe: keep the device powered and isolated, take a full backup or sysdiagnose, then seek analysis. Wiping first destroys the evidence that labs need.
Know your escalation partners: Apple points recipients to Access Now's Digital Security Helpline, which runs around the clock, and Citizen Lab also lists Amnesty International's Security Lab as a contact point. Citizen Lab does not take unsolicited general inquiries.
A clean scan is not an all-clear: indicator-based tools only find what has been published, and self-deleting implants leave little behind.

Handle a confirmed or suspected case under the Incident Response Guide, with legal counsel involved early.

Prevention and hardening

Hardening modes compared

Control	Apple Lockdown Mode	Android Advanced Protection
Messaging	Most attachment types blocked except certain images, video and audio; links and previews off	Scam Detection; protection depends on the messaging app
Web content	Complex web technologies blocked; per-site exclusions possible	Chrome JavaScript optimiser and WebGPU off, HTTPS enforced where possible
Cellular	2G and 3G off on iPhone and iPad	2G blocked on supported devices
Physical and USB	Device must be unlocked to connect accessories or computers	USB protection while locked; automatic reboot after 72 hours locked
Apps	Configuration profiles and MDM enrolment blocked	Sideloading blocked, Play Protect forced on
Memory safety and logging	Requires iOS 16 or later, more protections from iOS 17	Memory Tagging Extension for supported apps; optional Intrusion Logging

Decision guidance: Lockdown Mode blocks MDM enrolment and profile installation, so a corporate-managed iPhone cannot simply have it switched on. Options are a separate unmanaged hardened device for the high-risk role, enabling Lockdown Mode before enrolment (check current platform behaviour in a pilot, as this changes between releases), or accepting a reduced management footprint for a small named group. Small organisations with a handful of exposed people should favour the separate-device approach; large organisations need a written exception process and a register of who runs which mode. See the Mobile Device Security Guide for the wider fleet baseline.

Rollout for a high-risk user programme

Identify the population: name roles and individuals at elevated risk, including assistants and family where agreed, with a review every six months and before high-risk travel.
Pilot hardening: enable Lockdown Mode or Advanced Protection for two or three volunteers for two weeks, logging broken sites, apps and workflows. Exclude only trusted sites or apps, since every exclusion reduces protection.
Patch at speed: set a 72-hour target for OS and messaging app updates on high-risk devices when a fix addresses a KEV-listed or in-the-wild flaw; reboot daily.
Reduce data on the device: disappearing messages, minimal mail retention, no long-lived corporate secrets on the phone.
Strengthen accounts: phishing-resistant MFA on the user's Apple, Google and corporate accounts; see the Phishing-Resistant MFA Guide.
Prepare response: agree a forensic partner, an evidence procedure and a loaner device before any notification arrives.
Roll back safely: both modes can be turned off in settings after a restart; record the reason, set a review date and re-enable after the business need passes.

Where identity fits

A phone compromised by spyware is also a stolen identity token store. After a suspected case, revoke and reissue sessions, OAuth grants and device-bound credentials for every corporate service the device used, from a clean device, and review sign-ins for the period of exposure.

Lessons from incidents

Patched yesterday is not patched today: the Graphite and WhatsApp chains were zero-days when used, so speed of updating after disclosure decides exposure for everyone else.
Messaging apps and media parsers are the front door: BLASTPASS, Graphite, the WhatsApp chain and LANDFALL all arrived through content processed automatically.
Android is a target too: LANDFALL ran undetected for months on Samsung devices, so a programme that only covers iPhones leaves gaps.
Notifications are ignored or mishandled: recipients who wipe, factory reset or post screenshots lose evidence; train the high-risk group on what a genuine notice looks like.
Zero-days are a market: the same flaws that feed spyware appear in the wider exploited-vulnerability landscape. See the Zero-Day and Exploited Vulnerabilities Guide.

Policy and regulatory landscape

Measure	Date	What it does
US Commerce Entity List: NSO Group and Candiru	November 2021	Export restrictions on the two firms
US Executive Order 14093	27 March 2023	Bars US agencies from operational use of commercial spyware that poses counterintelligence or security risks or risks of improper foreign use
US Commerce Entity List: Intellexa and Cytrox	18 July 2023	Added for trafficking in cyber exploits
US Treasury OFAC sanctions on the Intellexa Consortium	5 March 2024	Two individuals and five entities designated over Predator
Pall Mall Process Code of Practice for States (UK and France)	Adopted 3-4 April 2025, Paris	Voluntary commitments on commercial cyber intrusion capabilities, initially backed by 25 States

These measures matter to defenders in two ways: they shape procurement (public bodies should check suppliers against them) and they signal which vendors remain active, but none of them removes the need for device hardening.

Framework mapping

Framework	Reference	Application
NIST CSF 2.0	ID.RA-01, PR.PS-02, DE.CM-09, RS.AN	Identify device vulnerabilities, keep software current, monitor high-risk endpoints, analyse incidents
NIST SP 800-53 Rev. 5	AC-19, SI-2, SI-3, SI-4, CM-7, IR-4	Mobile device control, flaw remediation, malicious code protection, monitoring, least functionality, incident handling
CIS Controls v8.1	Control 7, Control 10, Control 17	Vulnerability management, malware defences, incident response
ISO/IEC 27001:2022 Annex A	A.5.7, A.8.1, A.8.7, A.8.8	Threat intelligence, user endpoint devices, protection against malware, technical vulnerabilities
MITRE ATT&CK Mobile	T1664, T1456, T1658, T1404, T1430, T1429, S0316	Threat modelling and detection mapping

Practitioner checklist

Maintain a named, reviewed register of high-risk users, including assistants and agreed family members.
Enable Apple Lockdown Mode or Android Advanced Protection for that group after a pilot, with a written exception process.
Patch OS and messaging apps on high-risk devices within 72 hours of any in-the-wild fix, using CISA KEV as a trigger.
Turn on Android Intrusion Logging in advance so evidence exists if needed.
Publish a one-page notification procedure: verify at account.apple.com, do not wipe, isolate, call the security lead.
Pre-agree a forensic partner and evidence steps using MVT-compatible collection.
Revoke corporate sessions and credentials from a clean device after any suspected compromise.
Issue separate hardened devices for travel to high-risk jurisdictions.
Check suppliers against Entity List and sanctions actions in procurement of surveillance or forensic tools.

Standards and references

Related NHI Mgmt Group resources: Mobile Malware Guide · Mobile Device Security Guide · Mobile Threat Defense Buyer's Guide · Threat Intelligence Guide

Commercial Spyware Guide: Mercenary Spyware Risks and Protecting High-Risk Users