NSO Group spyware used to target widow of Mexican journalist, researchers say

The text messages sent to the widow, who is also a journalist, were laced with exploits that would have turned her phone into a multifaceted surveillance device.

A notorious piece of spyware has been used to target the wife of a slain Mexican journalist, security researchers said Wednesday, adding to ongoing public scrutiny of the company that developed the powerful surveillance tool.

Days after Javier Valdez Cárdenas, a reporter known for his coverage of international drug trafficking, was murdered in May 2017, multiple attempts were made to hack the phone of his widow, Griselda Triana, with spyware made by NSO Group, according to Citizen Lab, a digital rights and research organization at the University of Toronto.

The text messages sent to Triana, who is also a journalist, were laced with software that would have turned her phone into a multifaceted surveillance device, Citizen Lab researchers said. One of the messages tugged at her grief as a widow, asking, “What do you think of this story?”

Triana didn’t click on either link and turned the texts over to Mexican advocacy groups, which shared them with Citizen Lab for forensic analysis.

The surveillance tool aimed at Triana is known as Pegasus, the researchers said, an invasive malware strain developed by Israeli vendor NSO Group. The spyware uses a chain of exploits capable of accessing a target device’s microphone and camera, contact list, GPS location, and personal passwords.

Last November, Citizen Lab published evidence that two of Valdez’s colleagues received Pegasus-laden texts claiming to have evidence linking the Valdez’s slaying to a cartel.

The researchers said a Mexican government-linked organization was behind those attempted hacks. The links sent to Triana would have directed her to domains controlled by the same organization, Citizen Lab said. Researchers have not specifically identified that organization, referring to it only as RECKLESS-1.

There are now 11 documented cases of Pegasus being trained on journalists in Mexico and elsewhere, according to Citizen Lab. The spyware was allegedly used to track Saudi journalist Jamal Khashoggi before his brutal murder, according to a lawsuit filed against NSO Group by a Saudi dissident in December.

NSO Group co-founder Shalev Hulio has denied that the company’s technology was used to track Khashoggi.

NSO Group says it carefully vets customers and that governments use its products to fight crime and terrorism. But in addition to journalists, Pegasus has been used to target anticorruption watchdogs and political dissidents, according to Amnesty International and Citizen Lab. In Mexico alone, Citizen Lab has documented 25 people – including lawyers, politicians, and public health professionals – who have been targeted by Pegasus.

Pegasus, NoviSpy variant spyware found on devices of Serbian activists

It’s the first Pegasus infection of 2026 that Citizen Lab is forensically confirming, and the SHARE Foundation said it’s the biggest wave of spyware surveillance in Serbia…

Someone infected a spyware probe overseer with spyware

Meta accuses NSO Group of defying spyware injunction, files contempt of court complaint

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

Threats

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

• Dogged Russia-based botnet dismantled after 23-year run

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure

• Election official says Tina Peters would be consultant, won’t have access to election systems