Pegasus and other spyware: how is an infection detected on a smartphone?
Spyware does not show up on the screen, but it does leave traces. How an expert finds them on an iPhone or Android device, explained simply and without jargon.
In March 2026, prosecutors in Rome and Naples confirmed that the phones of an Italian news editor and two activists bore traces of an infection by Graphite, spyware sold by the company Paragon. The infection dated back to December 2024. More than a year later, the phone still "remembered" what had happened. Detection relies on exactly that memory.
Spyware cannot be seen, but it leaves traces
The most advanced spyware, such as Pegasus (NSO Group), Predator (Intellexa) or Graphite, is designed to stay invisible. It adds no icon, does not always slow the device down, and can be installed without the victim clicking on anything. Some variants even delete themselves after use.
But a modern smartphone keeps a genuine logbook. It records which programs ran and when, which services it connected to, which errors occurred and which data was transmitted. These logs normally help the system run properly. For the expert, they work like the security cameras in a building: the burglar may have taken his tools away, but his visit was recorded.
So our job is not to "find the software" on the phone. It is to reconstruct what happened, from the traces the device kept despite itself.
Pegasus is not alone
Pegasus is the best known, but it is only one example. Several companies have developed comparable tools, documented by public investigations in recent years:
- Pegasus, from the Israeli company NSO Group, exposed on a large scale by the "Pegasus Project" in 2021;
- Predator, sold by the Intellexa consortium, found in particular on the phones of journalists and politicians in Europe;
- Graphite, from the company Paragon, the spyware in the Italian case mentioned above;
- Hermit, developed by the Italian company RCS Lab, targeting iPhone and Android, documented in 2022 by Lookout and Google;
- Reign, from the Israeli company QuaDream, targeting the iPhone, documented in 2023 by the Citizen Lab and Microsoft. The company ceased operations shortly afterwards.
Names change, companies close or rebrand, but the principle stays the same. That is why detection does not rely on the name of a program, but on the traces every intruder eventually leaves.
Three ways to spot an intruder
Comparing against known fingerprints
Every documented spying campaign leaves signatures: unusual program names, server addresses used to send data out, characteristic behaviour. Independent research labs, such as the University of Toronto's Citizen Lab or Amnesty International's Security Lab, publish these "fingerprints" after each investigation. We compare the traces found on the device with these references, just as an investigator compares fingerprints against a database.
Spotting what does not belong
Known fingerprints are not enough: recent spyware has not been documented yet. So we also look for anomalies: a system program with an almost-correct name, a configuration profile installed without the user's knowledge, an app that has granted itself excessive permissions, connections to servers unrelated to how the phone is used. A single clue is rarely conclusive; it is the way the clues converge that matters.
Placing each trace in time
An isolated trace proves nothing. A dated trace, cross-checked with others and set against the user's daily life, becomes something to analyse. A message received at 3 a.m., followed by an app crash and then a connection to an unknown server: the timeline often tells more than each element on its own.
The most common threat is not the most talked about
So-called "mercenary" spyware, sold to governments, targets a limited number of people: journalists, lawyers, politicians, executives, activists. It is very expensive and its use remains targeted. Apple, which alerts users it believes have been targeted, sent a new wave of notifications in August 2026 to users in 110 countries. In total, users in more than 150 countries have received one since 2021.
In practice, the most common situation is different: monitoring software bought online and installed by a relative, a former partner or a colleague who had access to the phone for a few minutes. These tools, often called "stalkerware", are less sophisticated, but the consequences for the victim can be very serious. They are detected with the same method, and usually leave more traces.
What the analysis can and cannot do
Honesty calls for a caveat: the absence of traces does not prove the absence of infection. A phone's logs do not go back indefinitely, a factory reset erases most of them, and the newest tools may evade known methods. An analysis therefore concludes in measured terms: traces consistent with an infection, no traces found as of the date of the examination, or insufficient evidence to reach a conclusion.
When the findings are to be used in court, the method matters as much as the result. The acquisition is documented, the data is preserved and its integrity guaranteed, and every conclusion is tied to the evidence it rests on. That is the difference between an impression and proof.
Key takeaways
If you suspect a phone is being monitored, the first steps matter. Do not reset it and do not delete apps: you would erase the traces the analysis needs. Write down the dates and the events that alarmed you, keep any notification from Apple or Google, and use another device for sensitive conversations until the examination. For people at higher risk, Apple's Lockdown Mode significantly reduces the attack surface.
Cyber Praxis carries out these analyses on iPhone and Android, from the mobile security diagnostic to court-ready expert reports.