UAE Targets Human Rights Defender Ahmed Mansoor with NSO Pegasus Spyware

On August 10-11, 2016, Ahmed Mansoor, an internationally recognized UAE-based human rights defender and recipient of the Martin Ennals Award, receives suspicious SMS messages on his iPhone promising “new secrets” about detainees tortured in UAE jails. Instead of clicking the malicious links, Mansoor forwards the messages to researchers at Citizen Lab, who discover a sophisticated chain of zero-day exploits called “Trident” designed to install NSO Group’s Pegasus spyware.

Citizen Lab’s forensic analysis reveals that the links connect to exploit infrastructure operated by NSO Group, an Israel-based company selling government-exclusive “lawful intercept” spyware. The discovery represents the first public documentation of NSO’s Pegasus capabilities and its use against civil society targets. Given the high cost of iPhone zero-days and Mansoor’s history of UAE government harassment, researchers conclude the UAE government is the likely operator.

This case marks the third time Mansoor has been targeted with commercial spyware (previously FinFisher in 2011 and Hacking Team in 2012), establishing a pattern of Gulf state surveillance of dissidents. Mansoor’s decision to report rather than click the malicious links enables Apple to patch the vulnerabilities, potentially protecting countless others from state-backed surveillance. However, in March 2017, UAE authorities arrest Mansoor, and he remains imprisoned as of 2024, demonstrating the risks faced by those who expose government surveillance operations.