In 2018, Amnesty International reported that one of its researchers and a Saudi activist (later revealed to be Yahya Assiri) were targeted with Pegasus, the first reported cases by the NGO.
A New York Times investigation revealed the same year that the United Arab Emirates had planned to surveil, among others, Saudi prince Mutaib bin Abdullah using NSO Group’s technology.
In early October 2018, Citizen Lab reported that the phone of Canadian permanent resident and Saudi dissident Omar Abdulaziz was infected with Pegasus, and attributed the attack to an operator linked to Saudi Arabia.
In November, Forbes revealed that London-based Saudi dissident Ghanem Almasarir might have been targeted with Pegasus, and that both Almasarir and Abdulaziz were in frequent contact with Saudi journalist and activist Jamal Khashoggi, who was assassinated in October 2018. Abdulaziz filed a lawsuit against NSO Group in Israel, accusing the company of having helped Saudi Arabia to spy on his communications with Khashoggi.
In December 2018, the Washington Post wrote that Saudi Arabia had sought to purchase Pegasus.
In 2019, The Guardian reported that Ghanem Almasarir had accused Saudi Arabia of having hacked his phone using Pegasus. His letter of claim to the kingdom partly relied on the analysis performed by Citizen Lab.
In 2020, Citizen Lab reported that Saudi Arabia targeted New York Times journalist Ben Hubbard with Pegasus in 2018. The same year, the laboratory also detailed how 36 Al Jazeera journalists, producers, anchors and executives as well as one Al Araby TV journalist were hacked with Pegasus by four operators, including Saudi Arabia and the UAE. Israeli newspaper Haaretz wrote that with the official mediation of the Israeli government, NSO Group had signed contracts with several Gulf states, among them Saudi Arabia.
In July 2021, as part of the Pegasus Project, media members of the consortium, among them the Washington Post, revealed that shortly before or after the murder of Jamal Khashoggi, NSO Group’s spyware was used to target the phones of his wife Hanan Elatr, his fiancée Hatice Cengiz and one of his close associates (the consortium was able to prove that the attacks against Cengiz and Kashoggi’s associate were successful). The investigation also found the phone numbers of two other Khashoggi associates and two senior Turkish officials involved in the investigation into his homicide in the list of potential targets. The same month, the New York Times reported that NSO Group sold Pegasus to Saudi Arabia in 2017 and that it had canceled the contract after the assassination of Khashoggi in 2018 but that a new one was signed with the Kingdom in 2019, with the encouragement of the Israeli state. Overall, the Pegasus Project identified more than 200 Saudi numbers selected for potential surveillance.
In September 2022, Jamal Khashoggi’s wife, Hanan Elatr, announced she planned to sue NSO Group as well as the Saudi and Emirati governments in the U.S. over alleged surveillance attempts on her. The Washington Post reported in June 2023 that she had indeed launched a lawsuit in the U.S. against the Israeli firm.