The Spyware-Industrial Complex: Who Builds, Who Buys, Who Suffers

On 2 October 2018, the journalist Jamal Khashoggi walked into the Saudi consulate in Istanbul and did not walk out. His murder, carried out by a Saudi intelligence team, became a global scandal. What received less attention in the immediate aftermath was the technical infrastructure that made the operation possible. Investigators and researchers at Citizen Lab later established that Pegasus spyware, developed by the Israeli firm NSO Group, had been deployed against individuals in Khashoggi's circle, providing Saudi intelligence with the communications and movements of people close to the journalist. The spyware did not kill Khashoggi. But it provided the targeting data that made the killing operationally efficient.

This was not an isolated incident. It was a product of a structured industry that had been growing for a decade, an industry with identifiable vendors, documented clients, and a consistent victim profile. That industry has now reached an inflection point. In March 2026, a full iOS exploit chain called DarkSword appeared on GitHub, freely available to anyone with an internet connection. To understand what this means, one must first understand what came before.

The Architecture of an Industry

The commercial spyware sector is not a rogue operation. It is a structured market with known participants, documented transactions, and a recurring organizational pattern. The dominant cluster of vendors operates from Israel, where the pipeline between military intelligence and the private sector produces companies with unusual capabilities.

NSO Group, founded in 2010, developed Pegasus and became the industry's most visible firm. QuaDream, which operated until its dissolution in 2023, created a competing product called Reign. Candiru sold a spyware platform known as DevilsTongue. Paragon Solutions developed Graphite. Nearly all of these companies were founded by alumni of Unit 8200, the Israeli Defense Forces' signals intelligence directorate, the same unit that serves as a talent pipeline for much of Israel's technology sector.

The pattern is consistent: individuals develop surveillance capabilities within a state intelligence framework, leave military service, and commercialize those capabilities through private firms. The Israeli Ministry of Defense controls export licenses for these products, classifying them as defense articles. This creates a formal regulatory layer, but one that has historically approved exports to a wide range of clients.

Israel is not alone. Hacking Team, later reorganized as Memento Labs, operated from Italy. Nexa Technologies worked from France and was implicated in selling surveillance tools to the Libyan and Egyptian governments. FinFisher operated from Germany until it filed for insolvency in 2022 after an investigation by the Munich public prosecutor's office. In India, companies like BellTroX and Appin provided hack-for-hire services at lower price points, targeting not heads of state but business rivals and litigants.

The industry is concentrated but not monopolistic. It serves a global client base with a product that has few substitutes: the ability to remotely compromise a specific individual's mobile device without their knowledge.

The Client List

Citizen Lab, the research group at the University of Toronto's Munk School that has done more than any other institution to map this industry, identified at least 45 countries as suspected Pegasus operators in a landmark 2018 report covering activity between 2016 and 2018. The list defies simple categorization.

Saudi Arabia, the United Arab Emirates, Bahrain, and Morocco are confirmed operators, with forensic evidence of deployments against journalists and activists. Mexico deployed Pegasus extensively against journalists and civil society groups during the Peña Nieto administration. Rwanda used it against dissidents abroad. These cases fit the expected pattern of authoritarian governments surveilling domestic opposition.

But the client list also includes European Union member states. The European Parliament established the PEGA Committee in 2022 specifically to investigate spyware abuse within the bloc. The committee found evidence of Pegasus deployment in Poland, where the previous government used it against opposition politicians and a prosecutor. In Hungary, the Orbán government deployed Pegasus against journalists and a lawyer representing asylum seekers. Spain's CNI intelligence service targeted Catalan independence leaders in what became known as CatalanGate. Greece's national intelligence service used Predator, an Intellexa product, against a journalist and an opposition politician.

The analytical point is structural. The dividing line is not democracy versus autocracy. It is the presence or absence of functioning institutional oversight. Where judicial authorization for surveillance is weak, where parliamentary intelligence committees lack teeth, where press freedom is constrained, spyware abuse follows regardless of the formal regime type.

The United States placed NSO Group and Candiru on the Commerce Department Entity List in November 2021, restricting American firms from supplying them with technology. President Biden signed Executive Order 14093 in March 2023, prohibiting US government agencies from using commercial spyware that poses risks to national security or has been misused by foreign governments. These actions disrupted the industry's business model but did not dismantle it.

The Target Profile

The documented victims of commercial spyware form a remarkably consistent pattern across countries, regimes, and vendors. They are journalists, human rights activists, opposition politicians, lawyers, and their family members. The surveillance is political in function, whatever its stated legal justification.

The Pegasus Project, a 2021 investigation by the Forbidden Stories consortium involving 17 media organizations, identified a leaked list of over 50,000 phone numbers selected as potential surveillance targets by NSO Group clients. Forensic analysis confirmed Pegasus infections on devices belonging to journalists at Al Jazeera, Le Monde, the Financial Times, and other outlets. Citizen Lab identified at least 180 journalists in 20 countries as potential targets.

The phone numbers of French President Emmanuel Macron, South African President Cyril Ramaphosa, and Iraqi President Barham Salih appeared on the leaked list of numbers selected for potential surveillance. Amnesty International was unable to conduct forensic analysis on these leaders' devices, so it remains unknown whether infections occurred. These heads of state were selected not by their own governments but by other nations using Pegasus as an intelligence collection tool, a function indistinguishable from traditional espionage except in its technical means.

The most consequential cases, however, involve individuals without the security apparatus of a state to protect them. Ahmed Mansoor, a human rights activist in the UAE, was targeted with successive generations of commercial spyware: FinFisher in 2011, Hacking Team tools in 2012, and NSO Group's Pegasus in 2016. Citizen Lab's analysis of the Pegasus links sent to his phone in 2016 helped expose NSO Group's operations. Mansoor was arrested in 2017 and sentenced to ten years in prison on charges related to his activism. In Mexico, journalists investigating cartel connections to government officials were targeted, and several were subsequently killed.

The forensic methodology that underpins these findings gives them unusual evidentiary weight. Amnesty International's Security Lab developed the Mobile Verification Toolkit, an open-source tool that can detect traces of Pegasus and other spyware on mobile devices. These are not allegations based on circumstantial evidence. They are technical findings confirmed through forensic analysis of infected devices.

The Economics of Surveillance

Commercial spyware operates on a government-contract model. NSO Group reportedly charged clients a system setup fee of $500,000 plus approximately $650,000 to monitor ten targets for Pegasus, with volume discounts for larger deployments, though pricing varied by client and contract size. At its peak, NSO Group's annual revenue reportedly reached approximately $250 million.

These numbers reveal the market's fundamental incentive structure. For a government spending billions annually on intelligence, roughly $65,000 per target is inexpensive. A single Pegasus deployment provides access to a target's calls, messages, emails, camera, microphone, and location data without the risks and costs of physical surveillance. The cost-benefit calculation, from the buyer's perspective, is overwhelmingly favorable.

The upstream market for the raw materials of spyware, zero-day vulnerabilities, operates at even higher valuations. Zerodium, a vulnerability broker, publicly advertises payouts of up to $2 million for a full iOS zero-click exploit chain and $2.5 million for the equivalent on Android. The broader market for zero-day exploits is estimated to exceed $2 billion annually, though its opacity makes precise measurement impossible.

This economic architecture proved surprisingly fragile when subjected to external pressure. The US Entity List designation in 2021 restricted NSO Group's access to American technology, complicating its operations. Multiple lawsuits drained resources. By 2023 and 2024, NSO Group was in discussions about receivership. Intellexa's Tal Dilian was convicted in Greece in February 2026 and sentenced to eight years in prison. FinFisher collapsed in Germany. The commercial pressure did not eliminate the industry, but it disrupted its most visible participants.

Regulation: A Record of Failure

Every regulatory attempt to control the commercial spyware industry has arrived late, operated through the wrong framework, or been circumvented by corporate restructuring.

The Wassenaar Arrangement, an international export-control regime involving 42 participating states, includes surveillance tools in its dual-use technology list. But the Wassenaar Arrangement has no enforcement mechanism. Compliance depends on national implementation, and national implementation depends on political will. Israel is not a Wassenaar participant. Neither is the Wassenaar framework designed for software that can be transmitted as a file rather than shipped as physical goods.

Israel's Ministry of Defense does control export licenses and can restrict spyware sales. After the Pegasus Project revelations in 2021, Israel reportedly reduced NSO Group's approved client list from 102 to 37 countries. This was a significant contraction, but it came only after years of documented abuse and under intense international pressure. The ministry's export-control decisions are not subject to judicial review.

The Intellexa alliance demonstrated how corporate structure can defeat regulatory intent. The company's operations spanned North Macedonia, Greece, Ireland, and Hungary, allowing it to shift components of its business across jurisdictions as regulatory pressure mounted in any one location.

The EU PEGA Committee issued recommendations in 2023 calling for stricter controls, transparency requirements, and conditions for spyware use within member states. These recommendations have not been implemented as binding legislation. The committee's findings remain advisory.

The fundamental problem is architectural. Existing regulatory frameworks treat spyware as a trade issue, subject to export controls designed for physical weapons. Spyware is not a physical weapon. It is a service delivered remotely, updated continuously, and operated from any jurisdiction the vendor chooses. The regulatory tools available were designed for a different category of technology, and the gap between the tool and the problem has never been closed.

The Lawfare Front

Where regulation has failed, civil litigation has produced the most concrete results. The plaintiffs are not governments but technology companies whose platforms were exploited.

WhatsApp, owned by Meta, filed suit against NSO Group in October 2019, alleging that NSO exploited a vulnerability in WhatsApp's voice calling feature to deliver Pegasus to approximately 1,400 devices over a period of weeks. In December 2024, a US judge found NSO Group liable for violating federal hacking laws. In May 2025, a jury awarded WhatsApp approximately $168 million in damages. Apple filed its own suit against NSO Group in November 2021, seeking to permanently ban NSO from using any Apple product, service, or device.

These lawsuits achieved what export controls could not: they imposed direct financial consequences on the vendor and established legal precedent that developing exploits for commercial platforms constitutes actionable harm. The $168 million WhatsApp verdict, while small relative to the industry's total revenue, sent a signal that the legal risk of the spyware business had fundamentally changed.

Apple also took technical countermeasures. In 2022, the company introduced Lockdown Mode in iOS 16, a hardened security configuration specifically designed to protect users at high risk of targeted spyware attacks. Lockdown Mode disables numerous features that expand the device's attack surface: message link previews, certain web technologies, and inbound FaceTime calls from unknown contacts. Apple has also sent threat notifications to users in over 150 countries warning them of potential state-sponsored surveillance attempts.

The observation is structural. Technology companies have more enforcement power than governments in this domain because they control the platforms. Apple can push a security update to more than a billion devices within weeks. No government can legislate on a comparable timeline. This creates an accountability dynamic where corporate action substitutes for state regulation, not by design but by default.

The DarkSword Inflection

Against this backdrop, the appearance of DarkSword on GitHub in March 2026 represents something qualitatively different from the incremental evolution of the commercial spyware market.

Every tool in the spyware-industrial complex until now operated within a controlled distribution model. NSO Group sold to governments. Intellexa sold to governments. Even when these tools were exposed and analyzed, the exploit code itself remained proprietary. Researchers could document infections, analyze forensic traces, and identify victims, but the underlying capability remained behind a commercial paywall that limited access to state-level buyers.

DarkSword broke that model. A full iOS exploit chain, capable of zero-click compromise via manipulated web pages according to iVerify researchers, was uploaded to a public repository. The technical barrier to using military-grade mobile surveillance dropped from millions of dollars and a government procurement contract to a GitHub account and sufficient technical competence to compile and deploy the code.

The exploit chain targets WebKit and kernel-level vulnerabilities in iOS versions prior to 26.4. Apple patched the targeted vulnerabilities in its March 2026 security update. But hundreds of millions of iPhones running older iOS versions, including devices that cannot be updated to iOS 26, remain permanently exposed to the attack vector DarkSword exploits.

The distinction between the commercial spyware market and the post-DarkSword landscape is one of access control. The commercial market was an oligopoly: expensive, exclusive, and traceable through financial transactions. An open-source exploit kit is none of these things. The number of potential operators expands from dozens of government clients to any actor with basic offensive security skills. Attribution becomes harder. The economic incentive to exercise restraint in targeting, already weak in the commercial model, vanishes entirely when the tool is free.

The Proliferation Scenario

History provides a template for what follows when controlled offensive cyber capabilities reach the open internet.

In April 2017, a group calling itself the Shadow Brokers published a trove of NSA hacking tools, including an exploit called EternalBlue that targeted a vulnerability in Microsoft's Server Message Block protocol. Within weeks, EternalBlue was incorporated into WannaCry, a ransomware worm that infected more than 200,000 systems across 150 countries in May 2017. A month later, it powered NotPetya, a destructive attack attributed to Russian military intelligence that caused an estimated $10 billion in damages worldwide, hitting Maersk, Merck, FedEx, and Ukrainian infrastructure.

The pattern repeated with the 2015 leak of Hacking Team's source code. Within days, elements of the exploit code appeared in commodity malware kits used by cybercriminals with no connection to the surveillance industry.

DarkSword fits this pattern but with a critical difference in attack surface. EternalBlue targeted Windows systems in organizational networks, primarily servers and workstations behind corporate firewalls. DarkSword targets mobile devices carried by individuals, each device holding personal communications, banking credentials, biometric data, and real-time location. The attack surface is not institutional but personal.

The uncertainty must be named precisely. As of this writing, it remains unclear whether DarkSword's published code is fully functional as posted, whether it has already been integrated into existing malware toolkits, or how widely it has been downloaded and adapted. The code has been analyzed by iVerify and other security researchers, and Apple's emergency patch confirms that the underlying vulnerabilities were real. The gap between publication and weaponization at scale is a question of time and effort, not feasibility.

The spyware-industrial complex operated for over a decade as a controlled market where access to surveillance capability was mediated by price and procurement relationships. Those controls were imperfect, as the documented abuse by dozens of governments demonstrates. But they were controls. DarkSword represents the point where that market logic collapses. What replaces it is not a reformed market or a regulated one. It is an open proliferation environment in which the distinction between state and non-state, between targeted and indiscriminate, between commercial product and commodity tool, ceases to hold. Several hundred million iOS devices that will never receive the patch for the vulnerabilities DarkSword exploits remain in active use worldwide.