Pegasus is a commercial spyware platform associated with targeted surveillance against journalists, activists, lawyers, politicians, diplomats, executives, and other high-risk people. It is not the same problem as adware, a fake browser pop-up, or a Windows trojan from a random download. If you received an Apple or Google threat notification, work as if the device may be evidence and get expert help before wiping it.
Most readers are more likely to face phishing, password stealers, fake support scams, banking trojans, or malicious apps than Pegasus. That distinction matters: overreacting to every battery drain as “Pegasus” wastes time, while ignoring a real threat notification can destroy evidence that a specialist needs.
Received an Apple threat notification? Verify it first
Checked September 7, 2026: open a browser on a trusted device, manually enter account.apple.com, and sign in to the Apple Account concerned. Look for the threat-notification banner at the top of that page. Apple now also delivers alerts on the iPhone Lock Screen and in Settings, as well as by email; delivery can vary with the device and software. A screenshot or familiar sender name alone cannot authenticate a message.
Apple does not use these alerts to demand that you follow a link, download a file, install software or a configuration profile, or disclose your account password or a verification code by email or phone. Do not use contact details supplied by a suspicious message to verify it.
- The banner is present: treat the alert seriously and follow the response steps below. It indicates targeting with high confidence, not proof of a successful Pegasus infection, an identified attacker, or confirmed data theft.
- The warning appears only in an email or message: verify through the account page before acting on it. If a password or code was already submitted, follow the Apple Account recovery steps from a trusted device. Use the Apple phishing guide to inspect an unverified lure.
- It is a webpage popup or a notification from Shortcuts: that presentation alone is not Apple’s verified threat-notification channel. Check the account banner separately; for a browser warning demanding payment, a call, or a download, use the fake virus alert guide. Do not dismiss independent evidence of targeting just because a popup is fake.
Who is actually at risk?
Situation → Risk level and next step
- You received an official Apple or Google threat notification.
High. Preserve the device, document the message, and contact a trusted security expert or organization. - You are a journalist, activist, lawyer, diplomat, politician, or executive handling sensitive work.
Higher than average. Harden accounts, keep devices updated, and take threat notifications seriously. - Your phone is hot, slow, or losing battery quickly.
Weak signal by itself. Check ordinary causes first: apps, updates, storage, battery health, or common malware. - You clicked a suspicious SMS or WhatsApp link.
Possible phishing risk. Change passwords, revoke sessions, and check for account compromise, but do not assume Pegasus without stronger evidence.
Signs that matter more than rumors
Pegasus is designed to be quiet. Public “symptom lists” are often misleading because many normal phone problems look similar. The strongest signals are official threat notifications, confirmation from a reputable forensic team, unexplained account access connected to sensitive work, or evidence from mobile threat analysis tools used by specialists.
Weak signs include battery drain, random crashes, background data use, or the feeling that a phone is being watched. Those symptoms can happen with normal apps, a failing battery, a bad update, aggressive tracking apps, or ordinary account compromise.
What to do after a threat notification
- Do not delete the notification. Take photos or screenshots from another device if safe.
- Do not factory reset immediately if you need forensic review. Resetting can remove evidence.
- Update iOS or Android and high-risk apps. If a forensic specialist is already available, coordinate evidence capture before an update or restart; do not leave the device unpatched indefinitely while waiting for help.
- Move sensitive communication to a clean device and review account sessions from a trusted computer.
- Change passwords for email, cloud storage, messaging, social, and financial accounts.
- Contact a qualified security organization, employer security team, legal support group, or digital-safety hotline if your work puts you at risk.
Enable Lockdown Mode and preserve evidence
On a supported iPhone or iPad, open Settings → Privacy & Security → Lockdown Mode → Turn On Lockdown Mode, then follow the confirmation and restart prompts. Apple recommends current software for the fullest protections. Lockdown Mode limits some attachments, web features, and invitations; it reduces exposure but is not a scan or a certificate that spyware is absent. Enable it separately on other supported Apple devices used for sensitive work.
Keep the original alert, the approximate arrival time, the device model, and software version. Avoid factory resetting, deleting messages, or running cleanup scripts before advice. Ask a qualified responder how to preserve an appropriate backup securely; do not post a phone backup or diagnostic archive in a public forum. Use a separate trusted device for sensitive communication and account recovery.
Access Now’s Digital Security Helpline supports civil society, including independent journalists, activists, and human rights defenders. Its guidance recommends updating, enabling Lockdown Mode, and preserving a backup rather than erasing the phone. If you fall outside that remit, contact your employer’s security team or another qualified mobile-forensics specialist. Access Now does not issue Apple’s alerts or know the undisclosed reason for an individual notification. A consumer antivirus result cannot clear that warning.
Pegasus vs ordinary malware
Question → Pegasus
- Who is targeted?
Usually specific high-value people, not random home users at scale. - Can a normal Windows scanner remove it?
No. Pegasus is mobile spyware and requires mobile-focused forensic handling. - Should normal users still scan PCs?
Yes, when the real problem is phishing, a downloaded file, a suspicious installer, browser malware, or a Windows account stealer. - Is a factory reset always enough?
It may remove many threats but can also destroy forensic evidence and does not fix stolen passwords or cloud sessions.
What not to do if Pegasus is plausible
Do not install random “Pegasus removal” apps, do not follow social-media cleanup scripts, and do not hand the phone to an untrusted repair shop. If you are in a high-risk role, the device may contain evidence. A rushed reset can make later forensic work harder.
Also avoid moving all sensitive activity back onto the same phone immediately after changing passwords. Use a different trusted device for account recovery, legal communication, source protection, or emergency contact until you have expert guidance.
Practical hardening for high-risk users
- Keep iOS, Android, browsers, and messaging apps updated as soon as security patches are available.
- Use strong account recovery hygiene: hardware security keys where supported, unique passwords, and no reused SMS-only recovery path.
- Separate high-risk work accounts from casual browsing, shopping, and social apps.
- Disable unnecessary link previews and avoid opening unexpected attachments or calendar invitations.
- Back up important data, but remember that backups can preserve malicious profiles or unwanted app state.
When it is probably not Pegasus
If the problem started after installing a free APK, browser extension, game mod, cracked app, VPN, cleaner, or “phone booster”, ordinary malware or adware is more likely. If an email or SMS asked for a password, recovery code, wallet seed phrase, or payment, account phishing is more likely. Those problems still matter, but they require different steps than Pegasus-level spyware response.
For Windows symptoms such as fake virus alerts, browser redirects, suspicious processes, or startup entries, use a Windows malware cleanup workflow instead of a Pegasus checklist. The word “spyware” is broad, but the response has to match the platform and evidence.
FAQ
Can Pegasus infect a phone without clicking a link?
Some high-end spyware campaigns have used zero-click techniques. That is one reason official threat notifications and specialist analysis matter more than casual symptom checks.
Can Gridinsoft Anti-Malware remove Pegasus?
No. Gridinsoft Anti-Malware is for Windows malware cleanup and related file/process threats. Pegasus-level mobile spyware should be handled by qualified mobile forensics specialists.
What should ordinary users focus on instead?
Most users should focus on phishing links, stolen passwords, malicious apps, browser pop-ups, fake support tools, and suspicious downloads. Those threats are far more common than Pegasus.
References
- Apple Support. “About Apple threat notifications and protecting against mercenary spyware.” Apple, updated August 13, 2026; accessed September 7, 2026. Apple threat-notification guidance.
- Amnesty International Security Lab. “Forensic Methodology Report: How to catch NSO Group’s Pegasus.” Amnesty International, July 2021, accessed June 13, 2026. Amnesty’s Pegasus forensic methodology.
- Apple Support. “About Lockdown Mode.” Apple, accessed September 7, 2026. Lockdown Mode controls and limitations.
- Access Now. “Access Now’s Digital Security Helpline and Apple threat notifications.” Accessed September 7, 2026. Helpline response guidance and eligibility.
