Commercial Spyware Vendors Zero-Day Exploitation: Threat Model 2026
Reach 50,000+ security professionals
Sponsor a newsletter slot and put your brand in front of CISOs, engineers, and IT decision-makers.
Commercial surveillance vendors have matured into APT-tier threat actors, regularly chaining iOS and Android zero-days to deliver spyware without user interaction. This guide maps NSO Group Pegasus, Intellexa Predator, and Paragon Graphite capabilities to detection signals, mobile hardening controls, and enterprise protection programs for high-value targets. For prioritizing patches against known exploited vulnerabilities, see the CISA KEV patch prioritization automation guide.
Commercial Spyware Vendor Landscape in 2025-2026
Three vendors dominate the commercial spyware market. NSO Group's Pegasus remains the most documented, with confirmed deployments in over 45 countries and a consistent track record of iOS zero-click exploitation via iMessage and WebKit. Intellexa's Predator platform targets both iOS and Android through one-click delivery via injected network redirects, often delivered by ISP-level interception. Paragon's Graphite focuses on encrypted messaging apps, achieving code execution through WhatsApp and Signal zero-days.
All three vendors operate under government licensing agreements, claim lawful intercept use cases, and maintain plausible deniability through intermediary resellers. In practice, their tools consistently appear in campaigns against civil society, opposition figures, and corporate espionage targets. The 2025 Paragon deployment against Italian journalists and the 2024 Intellexa infrastructure exposure in Greece demonstrate that these platforms operate outside any meaningful accountability framework.
Enterprise threat models must treat these vendors as equivalent to nation-state threat actors in terms of technical capability. The key differentiator is targeting: commercial spyware is frequently deployed against business executives, legal counsel, M&A advisors, and journalists covering corporate or political subjects.
Zero-Day Exploitation Patterns
Commercial spyware vendors maintain stockpiles of unreported zero-day vulnerabilities, purchasing from independent researchers and operating internal discovery teams. Exploitation chains typically target the attack surface of default-enabled components: iMessage parsers, WebKit rendering, kernel privilege escalation, and baseband firmware.
Zero-click delivery chains require no user action. The attacker sends a specially crafted iMessage, push notification, or calendar invite. The payload processes automatically in a sandboxed context, achieves code execution, then escalates privileges through a kernel exploit. The final stage installs the spyware implant and clears traces.
One-click chains require a single tap on a link. Intellexa's Predator frequently uses HTTPS network injection at the ISP level, replacing legitimate HTTP redirects with attacker-controlled URLs. The target sees what appears to be a normal page redirect before exploitation occurs.
Patching cadence matters. Apple and Google issue emergency patches within days of zero-day discovery, but commercial spyware vendors have burned through three to five zero-days per major campaign before exposure. Organizations should enforce automatic OS update policies and treat any device running outdated iOS or Android as a potential compromise candidate for high-risk individuals.
Briefings like this, every morning before 9am.
Threat intel, active CVEs, and campaign alerts, distilled for practitioners. 50,000+ subscribers. No noise.
Target Profiles and Sector Risk Assessment
Commercial spyware campaigns concentrate on specific target profiles. Journalists and activists face the highest documented targeting frequency, but corporate targeting is increasing. M&A advisors, arbitration lawyers, energy sector executives involved in contested negotiations, and biotech researchers have all appeared in documented campaigns.
Sector risk correlates with the sensitivity of information the target handles. Finance and legal sectors face elevated risk during hostile takeovers, regulatory investigations, and cross-border disputes where information asymmetry has measurable financial value. Healthcare and biotech targets appear in campaigns tied to intellectual property theft. Government contractors face targeting aligned with the clients they serve.
Geographic concentration matters. Middle Eastern and Southeast Asian government clients are heavily documented Pegasus customers. European clients, despite EU legal restrictions, have included Hungary and Greece. North American clients include law enforcement and intelligence agencies under lawful intercept frameworks, though the same infrastructure is frequently misused.
Risk assessment should focus on three questions: does the target handle information with seven-figure financial or strategic value, does the target communicate with government officials or adversarial foreign nationals, and does the target travel to high-risk regions where device interception at border crossings is documented.
Mobile Device Hardening for High-Value Targets
iOS Lockdown Mode is the most effective single control for reducing commercial spyware exposure. It disables iMessage link previews, blocks complex web technologies in Safari, restricts incoming FaceTime calls, and prevents device management profiles from non-MDM sources. Enable it for all high-risk individuals. Usability impact is real but manageable for most executive workflows.
For Android, disable ADB over USB in developer settings, enforce full-disk encryption, and disable Bluetooth and NFC when not in active use. Avoid sideloading and restrict installation to Play Store only via enterprise policy. Enable Google Play Protect and configure it to send unknown app analysis to Google.
Network controls complement device hardening. iCloud Private Relay masks the client IP from websites and prevents network-level injection attacks that deliver one-click exploits. Enable it for all high-risk users on iOS. For Android, configure a trusted VPN as an always-on profile to prevent ISP-level injection.
Physical security remains a gap. Spyware can be installed via physical access in under two minutes. High-risk individuals should treat unattended device access as equivalent to network compromise. Travel devices that are dedicated, minimally configured, and wiped after high-risk travel reduce exposure.
Application selection matters. Use Signal for sensitive communications. Avoid third-party keyboard applications, which have full keylog access on both platforms. Disable rich link previews in all messaging apps where the setting exists.
MDM-Based Detection Signals
Mobile Threat Defense (MTD) platforms including Lookout, Zimperium, and Jamf Protect provide the best available detection coverage for commercial spyware, though no solution detects zero-day implants before vendor signature updates.
MDM-based detection signals to monitor include: unexpected configuration profile installations, elevated battery drain inconsistent with device usage, network connections to known spyware command-and-control infrastructure, process execution anomalies visible through MTD agents, and device behavior changes such as microphone or camera activation without user-initiated app use.
Integrate MTD alerts into your SIEM. Create detection rules for connections to Pegasus, Predator, and Graphite infrastructure indicators published by Amnesty International's Security Lab and Google TAG. These include DNS lookups to known C2 domains, certificate fingerprints, and anomalous network traffic patterns from messaging app processes.
MVT (Mobile Verification Toolkit), maintained by Amnesty International, provides forensic analysis of iOS backups and Android filesystems for spyware indicators. Run it on suspected devices before deploying remediation. The toolkit checks process lists, network connections, application history, and crash logs against known Pegasus and Predator indicators of compromise.
Enterprise Protection Program Design
Build a tiered protection program based on target risk profile rather than applying uniform controls. Tier 1 covers the highest-risk individuals: board members, C-suite, legal counsel, M&A deal teams, and investigative journalists. This tier gets Lockdown Mode, dedicated travel devices, MTD enrollment, quarterly forensic checks with MVT, and incident response protocols specific to mobile compromise.
Tier 2 covers elevated-risk individuals: senior managers in regulated business lines, government affairs staff, and procurement teams handling sensitive vendor relationships. This tier gets MTD enrollment, OS update enforcement, network controls, and annual security briefings on spyware risks.
All employees benefit from baseline controls: MDM enrollment, OS update enforcement, and app allow-listing.
Document a commercial spyware incident response procedure. Suspected Pegasus infection differs from ransomware response. Preserve the device for forensic analysis before wiping. Engage an external forensics firm with mobile spyware experience. Notify legal counsel immediately given potential surveillance law implications. Assess which communications the implant may have accessed and notify affected parties.
Maintain threat intelligence subscriptions that include commercial spyware indicator feeds. Amnesty Tech, Google TAG, and Citizen Lab publish indicators and campaign reports. Configure your SIEM and MTD platform to consume these feeds automatically.
The bottom line
Commercial spyware is no longer a nation-state-only threat. Any organization with high-value targets, executives, board members, or staff handling sensitive negotiations faces realistic exposure. Deploy Lockdown Mode for at-risk individuals, enforce MDM-based compliance checks, and integrate mobile threat defense with your SIEM. Treat commercial spyware indicators the same as APT implants: immediate isolation, forensic imaging, and incident response.
Frequently asked questions
What is the difference between commercial spyware and nation-state malware, and why does it matter for enterprise defense?
Commercial spyware vendors sell to government clients under lawful intercept licenses, but their tools use the same zero-day exploit chains as nation-state actors. The practical difference for enterprise defense is motivation: nation-state malware targets strategic intelligence, while commercial spyware is frequently used for economic espionage, litigation advantage, and suppressing dissent. Any organization whose executives handle high-value negotiations or regulatory matters faces realistic commercial spyware exposure regardless of geopolitical position.
How does iOS Lockdown Mode reduce commercial spyware risk, and what functionality does it restrict for enterprise users?
Lockdown Mode disables the most common delivery channels for zero-click spyware: iMessage link previews and complex message attachments, some Safari web technologies, incoming FaceTime from non-contacts, and wired connections to accessories when the device is locked. It also blocks non-MDM configuration profiles. Enterprise users lose some collaboration convenience but retain core communication and productivity functions. For high-risk individuals, the tradeoff strongly favors enabling it.
What specific indicators of compromise should security teams monitor for Pegasus and Predator infections on managed mobile devices?
Monitor DNS lookups to known Pegasus and Predator C2 domains published by Amnesty International's Security Lab and Google TAG, elevated battery drain with no corresponding usage increase, network connections originating from messaging app processes to unexpected external IPs, and configuration profile installations outside your MDM. Run MVT (Mobile Verification Toolkit) on iOS backups quarterly for high-risk individuals. MTD platforms like Lookout and Zimperium provide real-time behavioral detection.
If a corporate executive's device is suspected to be compromised by commercial spyware, what are the immediate response steps?
Do not wipe the device immediately. Preserve it for forensic analysis by placing it in airplane mode to prevent further C2 communication while retaining evidence. Engage an external forensics firm with mobile spyware experience. Run MVT against the iOS backup or Android filesystem image. Assess which communications and applications were active during the suspected compromise window. Notify legal counsel given surveillance law implications. Issue a clean replacement device while forensics proceed.
How should organizations identify which employees need Tier 1 commercial spyware protections versus standard mobile security controls?
Tier 1 applies to individuals whose device compromise would yield information worth more than a seven-figure threshold to an adversary, or whose exposure would create significant legal, regulatory, or reputational harm. This typically includes board members, C-suite executives, M&A deal teams during active transactions, legal counsel handling sensitive litigation, government affairs staff, and journalists at investigative outlets. Review the list semi-annually and adjust as roles change.
What network-level controls can reduce the risk of commercial spyware delivery through ISP-level injection attacks targeting Android devices?
Configure always-on VPN profiles via MDM to route all traffic through a trusted gateway, preventing ISP-level injection of attacker-controlled redirects. Enable DNS-over-HTTPS or DNS-over-TLS to prevent DNS hijacking that redirects traffic to spyware delivery infrastructure. Disable HTTP (port 80) traffic in enterprise networks and enforce HSTS for internal web applications. These controls address the one-click delivery model used by Intellexa Predator but do not protect against zero-click iMessage-based attacks.
Sources & references
Free resources
Critical CVE Reference Card 2025–2026
25 actively exploited vulnerabilities with CVSS scores, exploit status, and patch availability. Print it, pin it, share it with your SOC team.
Ransomware Incident Response Playbook
Step-by-step 24-hour IR checklist covering detection, containment, eradication, and recovery. Built for SOC teams, IR leads, and CISOs.
Daily briefings + Google Top Stories in one step.
Enter your email and we'll subscribe you to the daily briefing and add Decryption Digest to your Google Search feed at the same time.
Founder & Cybersecurity Evangelist, Decryption Digest
Cybersecurity professional with expertise in threat intelligence, vulnerability research, and enterprise security. Covers zero-days, ransomware, and nation-state operations for 50,000+ security professionals every morning.