In November 2021, four months after the Pegasus Project, Salvadoran digital newspaper El Faro reported that 12 of its employees, two leaders of civil society organizations and two opposition politicians had been informed by Apple that they had been targeted by a “state-sponsored attacker.” On the same day, Apple announced it had filed a lawsuit against NSO Group.
In January 2022, research laboratory Citizen Lab and non-profit Access Now confirmed that the phones of 35 Salvadoran journalists and civil society members had been infected with Pegasus spyware between July 2020 and November 2021. The findings, which were peer-reviewed by Amnesty International’s Security Lab and shared with Forbidden Stories, suggested the spyware operations had been conducted by the Salvadoran government. Among other things, the investigation showed that more than half of El Faro's staff was hacked, and that the attacks against them often coincided with the publication of articles that might have upset the government. (The office of the president of El Salvador and the Salvadoran embassy in Paris did not respond to multiple requests for comment from Forbidden Stories, and the government of El Salvador later denied allegations of hacking in response to questions sent by Reuters).
A few days later, at a hearing at the Inter-American Commission on Human Rights, officials from international organizations, including the UN, called for a ban on NSO’s spyware.
In November 2022, 15 staffers at El Faro filed a lawsuit against NSO Group in California, the first lawsuit brought by journalists against the Israeli company in the U.S.