Pegasus spyware
Pegasus is commercial mobile spyware associated with NSO Group. When successfully deployed, it can turn a phone into an access point for communications, files, location, contacts, and device sensors. Some documented infection chains required no interaction from the target.
Citizen Lab attributed extensive Pegasus infections in El Salvador to a customer operating mainly inside the country, with journalists at El Faro among the people affected. Attribution to a specific government was not established in that report.
Pegasus demonstrates a boundary condition for ordinary privacy tooling: end-to-end encryption does not protect a message after an endpoint is fully compromised. The El Faro case in Case for privacy and security also shows the collective harm to colleagues, sources, and future reporting relationships.