UAE Installs Pegasus Spyware on Khashoggi's Wife's Phone Months Before His Murder

On April 22, 2018, UAE government authorities install NSO Group’s Pegasus spyware on the phone of Hanan Elatr, wife of Saudi journalist Jamal Khashoggi, during her detention at Dubai International Airport. Forensic analysis by Citizen Lab and the University of Toronto reveals that after Elatr completed a 15-hour flight from Toronto to the UAE, immigration officials detained her and manually installed the surveillance software on her device - a method requiring physical access to the phone.

This targeting follows months of unsuccessful remote infection attempts. Between November 2017 and April 2018, an unknown operator sent six SMS text messages containing malicious links to Elatr attempting to install Pegasus remotely, with five messages arriving over 18 days in November 2017 and a sixth on April 15, 2018. When these phishing attempts failed, UAE authorities resorted to manual installation during her airport detention just days later.

The UAE’s systematic surveillance of Elatr occurs six months before Khashoggi’s assassination by Saudi agents inside the Saudi consulate in Istanbul on October 2, 2018. Following the murder, Khashoggi’s fiancée Hatice Cengiz’s phone is successfully compromised with Pegasus just four days later, with additional infections occurring five more times in subsequent days. The coordinated targeting of women closest to Khashoggi by Gulf state intelligence services using Israeli commercial spyware demonstrates the international surveillance infrastructure enabling authoritarian regimes to monitor dissidents and potentially facilitate political violence. The case raises disturbing questions about whether surveillance of Khashoggi’s associates contributed to planning his assassination.