Pegasus, Predator and Paragon frequently appear in the same reports about compromised phones belonging to journalists, politicians, diplomats and activists. They are not, however, three names for the same program. Pegasus is spyware developed by NSO Group, Predator is associated with Cytrox and the Intellexa alliance, while Paragon Solutions is the company behind a tool called Graphite.
These systems differ in their technical design, infection methods and capabilities. What they share is a fundamental principle: they are highly specialised commercial spyware products intended for the targeted surveillance of specific individuals.
Spyware that does not need to steal your phone
Conventional malicious software often tries to persuade as many people as possible to open an attachment, install a fake application or enter a password on a fraudulent website. Commercial spyware operates differently. An attack may be prepared for a single individual and may exploit vulnerabilities that are not publicly known.
Some infection chains require the target to click a malicious link. Others are described as zero-click attacks because a device can be compromised without any active interaction from the user—for example, through a specially crafted message or network communication.
This is why relying solely on the rule “I never click anything suspicious” is not enough. It remains important, but it may not be decisive against the most advanced attacks.
Pegasus: synonymous with targeted surveillance
Pegasus, developed by the Israeli company NSO Group, has become the best-known representative of this category. Researchers have repeatedly documented its deployment against journalists, human rights defenders, political figures and other high-profile individuals.
Following a successful compromise, such a tool may gain access to highly sensitive parts of a phone. It can potentially expose communications, photographs, location information, contacts and other data that the user considers protected by application-level encryption.
Encrypted communication protects a message while it is being transmitted. If an attacker controls the endpoint itself, they may access the content once it is displayed or stored on the phone.
Apple states that mercenary spyware attacks are exceptionally costly, complex and directed at a very small number of people. Most users will never encounter them, but they represent some of the most advanced digital threats facing selected targets. Apple therefore sends specialised threat notifications to affected users.
Predator: a different vendor with a similar objective
Predator was originally associated with Cytrox, which became part of the wider Intellexa alliance. Documented cases show that it can be delivered through targeted links, network infrastructure or more advanced infection mechanisms.
In one of its best-known findings, Citizen Lab described the phone of an Egyptian opposition politician on which Pegasus and Predator were running at the same time. The device had therefore been compromised by two different spyware systems operated by two separate government clients. The case demonstrates that the problem is not limited to a single company or brand. Citizen Lab published a technical analysis of the case.
Paragon is not the name of the spyware
The third name requires some clarification. Paragon Solutions is a company, while its surveillance tool is called Graphite.
According to Citizen Lab research, Graphite focuses particularly on obtaining access to communications in instant-messaging applications. In 2025, WhatsApp notified users believed to have been targeted by a zero-click attack linked to Paragon. Subsequent forensic analysis confirmed traces of Graphite on the phones of several journalists. Citizen Lab published an analysis of both the infrastructure and the compromised devices.
Graphite may not operate in exactly the same way as Pegasus or Predator. From the target’s perspective, however, the result is similar: private communications can be obtained directly from the endpoint without breaking the encryption used by the messaging service.
What do all three systems have in common?
Their most important shared characteristic is not a specific infection method, but their commercial and operational model. These tools are developed by private companies and offered to governments or security customers for targeted surveillance.
They typically share:
-
a focus on specifically selected individuals,
-
the use of undisclosed or newly discovered vulnerabilities,
-
an effort to operate without visible warnings,
-
the collection of data directly from the compromised phone,
-
communication with external command infrastructure,
-
the high cost and technical complexity of the attack.
Differences may include the level of access obtained, persistence on the device, infection vector and the types of data being targeted. Their capabilities also evolve continually in response to operating-system updates and the development of new exploits.
How does physical isolation change the situation?
A phone placed inside a Faraday bag cannot communicate normally through cellular networks, Wi-Fi, Bluetooth or other wireless interfaces. This changes one crucial part of the equation: the connection between the phone and the outside world.
If the device is already compromised, physical isolation may temporarily interrupt communication with command infrastructure and prevent collected data from being transmitted. It may also restrict the delivery of further remote commands. This can be important during incident response or while transporting a phone for forensic analysis.
Physical isolation does not remove spyware. It cannot recover data that has already been transmitted or delete malicious code from the phone. Some information may continue to be collected locally during isolation and could be transmitted after connectivity is restored.
A Faraday bag is therefore not an “antivirus against Pegasus”. It is a tool for temporarily controlling device communication and gaining time for the next professional steps.
When can a Faraday bag be useful?
Most people do not need to carry their phone inside a Faraday bag every day. For high-risk individuals, however, physical isolation may have a place during sensitive meetings, while transporting a device or immediately after receiving a credible warning about a targeted attack.
One option for these situations is the FWR Faraday Bag Small Gen. M, featuring a 12-layer shielding construction, magnetic closure and measured attenuation of up to 102 dB. If a suspected device is being transferred for professional examination and a record of physical handling is also important, a version with a sealing option is available.
This is only one part of the response. Someone who receives a credible security warning should not immediately erase, restore or begin exploring the phone without professional guidance. Unqualified actions may remove traces that are important for analysis. Seeking assistance from incident-response or mobile-forensics specialists is a safer approach.
The most effective protection begins before an attack
For ordinary users, the foundations remain an up-to-date operating system, a strong passcode, multi-factor authentication and caution when handling links and attachments.
People who may be targeted by highly sophisticated surveillance can also limit risky device functionality. Apple provides Lockdown Mode for these cases, reducing the available attack surface by restricting certain messaging features, web technologies and incoming services.
Pegasus, Predator and Graphite demonstrate that phone security is no longer simply a question of choosing a strong password. If an attacker gains control of the endpoint, they may circumvent the protections on which the user normally relies.
Physical isolation cannot resolve the threat on its own. It can, however, do one important thing: temporarily separate a compromised or threatened device from the infrastructure that the attacker needs for communication. During a security incident, the time gained may prove extremely valuable.
