Was Pegasus The Real Weapon Behind Iran’s Leadership Killings?

Pegasus spyware may have enabled the precise targeting and killing of Iran’s top leadership, raising serious questions about covert surveillance, accountability, and the global misuse of cyber-intelligence tools

Was Pegasus The Real Weapon Behind Iran’s Leadership Killings?

As many as 25 important top personalities of Iran, including its Supreme Leader, Ayatollah Ali Khamenei, various powerful ministers, top military commanders and generals, commanders of Iran-backed militias, and the intelligence head, were killed in US-Israeli strikes.

Whether all of them, or the majority of them, were killed by deploying the world’s most infamous Pegasus surveillance system—the product of the Israeli private company NSO Group—like the thousands of ‘pagers’ used by Hezbollah operatives in Lebanon to explode almost simultaneously?

Who designed, who deployed, and who orchestrated thousands of ‘pagers’ to kill the entire range of Hezbollah? It was Unit 8200, the most lethal signals branch of Israel’s intelligence agency. Late Hezbollah chief Hassan Nasrallah, when he was alive, also claimed that Israel was using cell phone networks to pinpoint the locations of his operatives, without elaborating on which agency had authored the blasts, nor was he precisely aware of Unit 8200.

One of the three owners of the Israeli private company NSO, which produced Pegasus spyware, is a retired senior officer of Unit 8200, and a major chunk of the employees of NSO comprises those who joined the company after retirement from Unit 8200.

NSO’s Pegasus surveillance system is capable of ‘zero-click’ exploits, which allow the client to control the phone without any action on the target's part. Once successfully installed on the phone, Pegasus spyware gives NSO clients complete device access and the ability to bypass even encrypted messaging apps like WhatsApp, Signal, and Telegram.

Pegasus operators are able to remotely record audio and video, extract data from messaging apps, use GPS for location tracking, access photos and contacts, and activate the microphone and camera of the phone—effectively turning it into a spying tool.

Spying governments have, in recent years, moved towards a more ‘hit-and-run’ strategy to avoid detection by using—or rather misusing—the Pegasus system.

However, continuous large-scale investigations, especially a syndicated investigation by a global consortium of more than 80 journalists from 17 media outlets in 10 countries, coordinated by Forbidden Stories, with technical support from Amnesty International’s Security Lab, exposed that Pegasus targeted more than 50,000 cell phones, including 600 politicians and government officials (including rulers of different countries), around half a dozen members of Arab royal families, 64 business executives, 200 journalists, and 85 human rights activists and dissidents.

US was the only country to blacklist the Pegasus system, while all the remaining ‘client countries’ did not utter a single word and instead disowned having the Pegasus system either within their intelligence agencies, law enforcement agencies, or military organisations

Following this, NSO was blacklisted by former US President Joe Biden, who barred it from procuring materials needed for its software from US sellers, thereby limiting the use of NSO Pegasus by US federal agencies. It is worth noting that the US was the only country to blacklist the Pegasus system, while all the remaining ‘client countries’ did not utter a single word and instead disowned having the Pegasus system either within their intelligence agencies, law enforcement agencies, or military organisations, which are eligible to sign contracts with NSO. No private company or individual is authorised to contract with NSO.

It would be even more embarrassing for US President Donald Trump if the Pegasus surveillance system was used to trace and locate all those Iranian top leaders, including Ayatollah Khamenei, who were killed in US-Israel airstrikes, since the US government had blacklisted NSO in 2022, soon after various investigative reports by media consortia, Amnesty International, WhatsApp, non-profit organisations, and digital rights groups had lifted the veil on the secretive abuse of Pegasus spyware by more than 40 client countries.

Since the US and Israel started attacking Iran in 2023, NSO has been trying hard to demonstrate the value of the Pegasus tool, volunteering to help Israel’s security services track people kidnapped by Hamas. NSO tried to convince both the US and Israel to understand why they need NSO’s Pegasus spyware in a situation where they are facing enemies.

In a last-ditch effort before the installation of the Donald Trump administration, Paul Hastings, one of the lobbyists of NSO, sent a letter on behalf of the company requesting an urgent meeting with former US Secretary of State Antony Blinken and other State Department officials, emphasising that “war with Iran and Hamas required the necessary and urgent employment of NSO’s Pegasus cyber-intelligence technology.”

After being disappointed by Joe Biden, NSO has started working with a key new lobbying partner, the Vogel Group, whose principal staff had already worked with Donald Trump during his first administration.

Shortly after Donald Trump declared victory in November 2024, NSO Group co-founder and majority owner Omri Lavie rushed to X to congratulate him, speaking of a “new chapter where the world goes back to common sense,” while accusing the outgoing Biden administration of being “weak.” In another tweet, he wrote in Hebrew that Republicans had “won in every category: the presidency, Congress, Senate, and the popular vote.”

NSO Group poured more than $3 million into an aggressive 2024 pre- and post-election lobbying effort, focusing primarily on Republican senators and representatives aligned with Donald Trump.

Yet the company remains blacklisted, but nobody knows whether the US, Israel, or either of them is secretly using NSO’s Pegasus system to target Iranian top leadership. Pegasus can help the US and Israel to locate and track the movement of their targeted Iranian leadership from one safe place to another. Obviously, the killed Iranian leaders had taken extra cautious measures and reportedly shifted from one place to another, but could not prevent their ultimate deaths, including even Iran’s Supreme Leader Khamenei, along with his whole family. The new Supreme Leader, Mujtaba, was also hit, but Iran claims that he received minor injuries.

Nearly a decade ago, forensic investigators discovered that NSO’s hacking tool, Pegasus, was used by an unnamed client (likely Saudi Arabia) to hack the WhatsApp accounts of 1,400 customers

Killing them in missile airstrikes is not possible without first determining, tracing, or locating the Iranian leadership before the strike—and Pegasus spyware is known globally for this capability.

NSO, though a private Israeli company, has a majority of its employees, staff, and even one among its three partners who is a retired senior officer of Unit 8200. The Israeli army’s signals intelligence branch is the most effective human and cyber tool behind NSO. The same Unit 8200 is the signals branch of Israeli intelligence that reportedly enabled thousands of pagers used by Hezbollah operatives in Lebanon to explode almost simultaneously.

Primarily, the Israeli company NSO provided the Pegasus system only to law enforcement agencies, intelligence agencies, and military organisations of ‘client countries’ to target terrorists, money laundering, drug trafficking, smuggling, and criminal networks—only after approval from the Israeli Ministry of Defence. However, media reports claimed that subsequently, the same system was used not against terrorists and criminals, but against political opponents in client countries.

NSO claims that 60 government organisations from 40 countries are clients of Pegasus, but under commercial obligations, NSO cannot name them. Similarly, all client countries still do not admit to possessing the Pegasus system.

After a six-year-long legal battle, on 7 May 2025, a California jury issued a $158 million judgement against the Israeli spyware company NSO Group in a case brought by Meta Platforms, the owner of WhatsApp. Nearly a decade ago, forensic investigators discovered that NSO’s hacking tool, Pegasus, was used by an unnamed client (likely Saudi Arabia) to hack the WhatsApp accounts of 1,400 customers. Though we do not know which specific individuals were targeted, they were considered opponents of the ruling regime.

Amnesty International appreciated the court decision and declared it a major signal to spyware companies around the world that the period of impunity is winding down. It called on other technology companies, as well as governments, to use judicial mechanisms and other tools at their disposal to hold spyware companies accountable for illegal conduct and to ensure respect for human rights across the industry.

The digital rights NGO Access Now, which has led the legal fight, released a statement on the judgement: “We urge other companies whose infrastructure and users are targeted by NSO and other spyware companies to explore filing similar legal actions.”

The company has faced other lawsuits in US courts over Pegasus, including from Apple Inc. and Microsoft.

Despite winning lawsuits against NSO’s Pegasus spyware system, barely a month later, on 24 June 2025, Meta Platforms’ WhatsApp messaging service was banned from all United States House of Representatives devices, according to a memo sent to all House staff on Monday.

The notice stated that the “Office of Cybersecurity has deemed WhatsApp a high risk to users due to the lack of transparency in how it protects user data, absence of stored data encryption, and potential security risks involved with its use.”

The memo, from the Chief Administrative Officer, recommended using other messaging apps, including Microsoft’s Teams platform, Amazon’s Wickr, Signal, and Apple Inc.’s iMessage and FaceTime.

Meta Platforms disagreed with the move “in the strongest possible terms,” with a company spokesperson noting that the platform provides a higher level of security than the other approved apps.