Who bought Pegasus? Documented, reported and denied customers

analysisIn an opposition filed in the WhatsApp case on 4 November 2025, NSO Group Technologies and Q Cyber Technologies stated that all of NSO's customers are sovereign governments, as confirmed by the auditing firm EY, and that contracts and Israeli Defence Ministry licences require Pegasus to be used only against terrorism and serious crime; they referred to major US allies, including Western European democracies, among their foreign sovereign customers without naming them. These are the defendants' statements in court papers. According to answers NSO gave the European Parliament's inquiry committee in 2022, Pegasus was initially sold to 22 end users in 14 EU member states under Israeli marketing and export licences, and contracts with end users in two member states were later terminated; the committee could not confirm which states these were and assumed the two were Poland and Hungary. NSO did not name the member states. ^{1 2}

qualification

The 22 end users and the two terminated contracts are NSO's answers as stated in the European Parliament's 2023 inquiry report, which relies on the sources it cites.

analysisThe only customer contract in the retained documents is an agreement dated 17 December 2015, filed by the plaintiffs as an exhibit to the WhatsApp complaint. It provides for Infraloks Development Limited, a Ghanaian company (registration number CA-66,115) reselling and supplying cyber intelligence solutions developed by NSO Group Technologies, to supply a system to the National Communication Authority of the Republic of Ghana as end user; the system description refers to the System Provider's Pegasus system operating on Ghana mobile numbers, and an attached service level agreement is between NSO Group Technologies and Infralok Development Limited. The retained copy is a scanned text with recognition errors. ³

analysisThe Polish government, after initially denying it, confirmed the purchase of spyware in January 2022; the former head of the Supreme Audit Office, Krzysztof Kwiatkowski, presented to the Senate two invoices confirming a purchase for the Central Anti-Corruption Bureau (CBA) for PLN 25 million from the Justice Ministry's Justice Fund, issued by Matic Sp. z o.o. as intermediary. The report states that Hungary's Interior Ministry bought Pegasus for EUR 6 million in 2017 indirectly, through Communication Technologies Ltd, from NSO's company in Luxembourg, which it does not name, a purchase acknowledged in November 2021 by Lajos Kósa, chair of the parliamentary defence and law enforcement committee; Communication Technologies later sued the journalist Szabolcs Panyi after he investigated it. Hungary's data protection authority, which had access to the secret contract, said its inquiry found nothing inconsistent with NSO's terms of sale, though according to the report it verified only the authorisation procedure, not the substance of the use. ¹

qualification

The Polish invoices and the Hungarian purchase are stated in the European Parliament's 2023 inquiry report from the Senate testimony, press and the Hungarian authorities it cites.

analysisIt was reported in September 2021 that Germany's Federal Criminal Police Office (BKA) had acquired Pegasus in late 2020; according to the report NSO at first declined to modify the software to comply with German law but later agreed, so the BKA acquired a modified version, a purchase confirmed by the then BKA vice-president Martina Link in a closed parliamentary session. The report also states that in October 2021 Luxembourg's Prime Minister Xavier Bettel confirmed that Luxembourg bought and used Pegasus for reasons of state security. A Luxembourg business publication's headline of 28 October 2021 states that Bettel appeared to confirm the purchase but later backtracked on his comments; the article's text was not retained. ^{1 2}

qualification

The German and Luxembourg accounts are stated in the inquiry report from press and a closed parliamentary session it cites.

analysisOther governments' positions recorded in the report differ. Austria's government stated on 22 September 2021 that Austria had not been an NSO client; France's foreign ministry denied holding talks with NSO, although media reported that a French purchase was suspended in 2021; Belgium's justice minister declined to confirm whether Belgian intelligence was a client after a former Israeli intelligence official said Belgian police used Pegasus; and the Dutch government refused to comment on media reports of June 2022 that its intelligence service had used Pegasus to help the police track down a serious-crime suspect. These are denials, reports and refusals to comment, not records of contracts. The report concluded that, given the secrecy, it could not be determined whether the Spanish government concluded contracts with NSO or acquired and used Pegasus; Shalev Hulio, then NSO's chief executive, told a US magazine in April 2022 that Spain's use was legitimate given its respect for the rule of law and the requirement of Supreme Court authorisation, a remark about use rather than a contract. ¹

qualification

The governments' positions and Hulio's remark are those recorded in the inquiry report, which relies on the ministerial answers and press it cites.

analysisCiting press, the report states that Estonia negotiated with NSO in 2018 and made a down payment on a USD 30 million deal, after which Israel's Defence Ministry blocked it from using the spyware against Russian devices, and that in January 2020 NSO submitted to Greece an official proposal for a government-to-government agreement of EUR 50 million, an arrangement that was eventually called off; neither government's contract is in the retained documents. The report also cites a book alleging that a former NSO employee working for a company of Tal Dilian trained Cyprus's intelligence service in the use of Pegasus and that the Cypriot government bought equipment from Dilian's company. Cyprus's government told the committee that NSO holds no shares in Cypriot companies, that Pegasus did not appear to have been developed in or officially exported from Cyprus, and that NSO board members had set up or bought six companies there. ¹

qualification

The Estonian, Greek and Cypriot accounts come from press and a book cited by the inquiry report, set against Cyprus's own answer to the committee.

analysisCiting a book and Israeli press, the report states that in 2017 NSO officials presented Pegasus 3 to Saudi Arabian customers at the Four Seasons Hotel in Limassol, Cyprus, and that the Saudi customers bought it for USD 55 million; the report adds that a year later Saudi Arabia killed Jamal Khashoggi after surveilling people close to him with Pegasus, which NSO disputes. It also records a document from the Cypriot party AKEL alleging that NSO exported Pegasus through a Cypriot subsidiary to a company in the United Arab Emirates against an invoice of USD 7 million, which the report says cannot be confirmed. In a March 2025 US court filing, Treo NOAL GP, general partner of the fund that bought NSO in 2019, said that information it obtained after the 2021 Entity List designation showed NSO had been heavily dependent on collections from new sales to high-risk customers such as Saudi Arabia. These are unconfirmed allegations and a party's statement; no contract is in the retained documents. A British business newspaper reported in April 2022, citing three people with knowledge of the matter, that Mubadala Capital, a unit of an Abu Dhabi state fund chaired by Crown Prince Sheikh Mohammed bin Zayed al-Nahyan, was one of the largest investors in the €1 billion private equity fund that bought NSO in 2019, and that the Abu Dhabi government internally discussed buying NSO outright in autumn 2021, discussions that did not progress beyond preliminary conversations; Mubadala's stake in the fund is not quantified. ^{1 2 3 4}

qualification

The Limassol meeting and the AKEL document are stated in the inquiry report from a book, Israeli press and a party's document it cites.

analysisAccording to US public radio as cited in the report, Morocco had a licence for about 100,000 phone numbers, making it one of NSO's largest Pegasus clients. A 2026 investigation by an international journalism network, based on a former officer of Morocco's DGST intelligence service and a second former intelligence source, reported that the DGST procured and administered Pegasus through a private intermediary, which the reporters identified from the former officer's description as FSSYS Maroc in Rabat; no contract is in the retained documents, and the reporters found no evidence that the intermediary itself carried out infections. Morocco called the Pegasus Project accusations erroneous and has long denied using Pegasus, and Moroccan authorities, NSO and the chairman of FSSYS Maroc did not respond to the 2026 investigation's questions. ^{1 5}

analysisA 2026 investigation by an international journalism network reported that NSO sold Pegasus to Panama in 2012, with Shalev Hulio signing the contract with the Panamanian government, and that in 2023 Panama's Supreme Court sentenced two former officials to 50 months in prison for breaches of confidentiality and of the right to privacy related to Pegasus. It also reported that Panamanian migration records show Hulio entering Panama on 3 December 2013 on a diplomatic passport issued by Israel, with his profession given as "diplomat", a use that a former senior Panamanian official confirmed, and presented this as raising questions about the firm's stated independence from the Israeli state. Hulio called the allegations concerning a diplomatic passport and his purported role as a representative of Israel entirely false and categorically denied them; Israel's defence and foreign ministries did not respond. The contract, the Panamanian judgment and the migration records were not retained. ⁶

analysisThe European Parliament report, citing an international human rights organisation, names 14 non-EU countries whose authorities are most likely responsible for many cases of technically proven Pegasus infection: El Salvador, Mexico, Thailand, Morocco, India, Rwanda, Saudi Arabia, Bahrain, Jordan, Kazakhstan, Togo, the United Arab Emirates, Israel and Azerbaijan. This attributes infections to states; it does not document contracts with NSO. The report also states that Ability Ltd, founded by Anatoly Hurgin, cooperated with NSO on Pegasus and handled the network side of NSO's operations, and that in 2017 Ability was under investigation by the US Securities and Exchange Commission over alleged misstatements of its finances. ¹

qualification

The list of 14 states and the account of Ability are stated in the inquiry report, which relies on a human rights organisation's research and other sources it cites.