Proof on the phone: how researchers confirm commercial spyware

'Indicators consistent with'

The researchers who publish these cases write in a particular register. Citizen Lab describes infections with "high-confidence" indicators and ties them to a time window, not to an individual[S3]. The language is deliberate. Evidence of a spyware family’s infrastructure on a phone is not the same as knowing who operated it, and a notification from a platform vendor is a targeting signal rather than a verdict.

Sixty-seven phones

The clearest public numbers come from the Pegasus Project in 2021. A leaked list held over 50,000 phone numbers, and Amnesty Security Lab examined 67 phones whose owners volunteered them. Thirty-seven showed traces of Pegasus: 23 were successfully infected and 14 showed attempted targeting. Thirty were inconclusive, in some cases because the owner had replaced the device[S1]. Appearing on the list was not proof of anything.

The Android result is the sharpest lesson. Amnesty said that, unlike iPhones, Androids "do not log the kinds of information required" for its work, though three Android phones still showed signs of targeting[S1]. The ceiling on proof is partly set by how much the phone itself keeps.

Graphite, 2025: a confirmation from logs

In June 2025 Citizen Lab reported the first forensic confirmation of Paragon’s Graphite spyware on iPhones, in two cases[S2]. One journalist’s iPhone had been compromised in January to early February 2025 while running iOS 18.2.1. Apple said the zero-click attack was mitigated as of iOS 18.3.1, under the identifier CVE-2025-43200, and notified a select group of users on 29 April 2025[S2].

What made the case "confirmed" is instructive. It was not a recovered file. Citizen Lab pointed to device logs showing requests to a server that matched a known fingerprint, and to the account an attacker used to send messages[S2]. Figure 2 sets the dates side by side. The server contact was logged until at least 12 April 2025, weeks after the fix, which is why the timeline matters as much as the artifact.

Citizen Lab’s report did not identify the operator or customer behind these cases[S2].

Serbia, 2025 to 2026

The newest cases follow the same pattern. On 2 September 2026 Citizen Lab, working with the SHARE Foundation, reported that a member of a student protest movement had an iPhone infected with Pegasus through a zero-click iMessage exploit, with high-confidence indicators from December 2025 to January 2026. The individual had received an Apple threat notification, and at least 14 people in the movement, civil society and an opposition party had received similar notices[S3]. Citizen Lab advises people at risk to enable Lockdown Mode and to treat a notification as presumed compromise[S3].

A second report on 19 October 2026 added a senior university official whose iPhone was infected in 2026, and another person who received notifications on 13 and 27 August 2026 but whose infection was not confirmed[S4]. The reports we read name no government as the operator.

How rare is a confirmation?

Rare, and the rarity is itself a measurement problem. Apple says it has notified users in over 150 countries since 2021 and that the vast majority of users will never be targeted[S8]. Google’s Threat Intelligence Group reported for 2025 that, for the first time since it began tracking, it attributed more zero-day exploitation to commercial surveillance vendors than to traditional state-sponsored espionage groups[S12]. Neither statement is a prevalence rate for the public. Published confirmed cases are far fewer than the notified population, and how many of the rest were compromised is unknown.

Why the evidence is thin

Several things work against a confirmation. Some implants do not survive a restart: a Google Project Zero teardown of one iOS implant found it did not persist across reboots, and that "There is no visual indicator on the device that the implant is running"[S6]. Some clean up: Google’s analysts reported that all three families in a web-delivered kit deleted crash logs[S9]. In Kaspersky’s four-year Operation Triangulation case, the message and exploit were removed, and the strongest indicator was a trace of a process, not the attachment[S7].

Some implants watch the examiner. Google’s Intellexa report describes a component that ends the infection if it detects signs of analysis, and notes that the absence of artifacts after tooling is therefore not proof of absence[S5].

Three kinds of finding, not one

A research finding, a court ruling and a government action are different things. A US federal court found NSO Group liable for 2019 attacks on WhatsApp in December 2024 and issued a permanent injunction in October 2025 that does not cover NSO’s customers or other Meta products; NSO has appealed[S10]. NSO has been on the US Entity List since November 2021, according to TechCrunch in January 2026[S11]. Those are not conclusions about any individual phone, and the status of each may have changed since the cited dates. A researcher’s finding about a phone is a different, narrower claim.

Our assessment: confirmation is a ladder

The Lab reads the published cases as a ladder. A notification or a suspicion is the bottom rung. Expert review, device artifacts, server and account indicators and a documented time window climb toward confirmation, and most phones stop at some middle rung. That is not failure; it is the honest result when an implant is built to leave little.

The rungs are not equal. A log entry showing contact with a server that matches a known fingerprint is stronger than a notification, and a server fingerprint plus an attacker’s account is stronger still. But each rung depends on what the phone kept and on the researchers’ reference data.

Two consequences follow. First, a good outcome is a defensible, scoped statement: what was examined, what period it covered, what was found, and what could not be decided. Second, a negative is never an all-clear.

What the Lab is watching

• Further research reports on the Serbian cases and any operator attribution.
• Court activity in the NSO appeal, and the Entity List status checked against the primary record.
• Whether platform vendors expand the logs that survive on iOS and Android.

What this means for examiners

Keep the notification itself, with its date and how it was verified[S8]. Preserve the device rather than resetting it. Ask what the evidence can support before asking what the answer is. A phone that returns "inconclusive" has told you something true about the limits of its own records. Say so in plain words to the client, with the reason: a replaced device, a short log window or an implant built to leave little are all ordinary explanations, and none of them is a finding about the owner.