Pegasus spyware email: Is it real or a scam?

Pegasus spyware has been used to surveil terrorists, criminals, and, in some cases, journalists, activists, and political figures. But if you receive an email claiming that Pegasus has infected your device and that the sender has compromising information about you, it’s almost certainly a scam designed to intimidate you into paying money to cybercriminals.

In this article, we’ll explore the difference between real Pegasus spyware and the fake Pegasus scam emails, who each threat typically targets, and what to do if you encounter either.

What is a Pegasus spyware email?

A Pegasus spyware email usually refers to a scam email that falsely claims your device has been infected with Pegasus spyware. These messages are typically part of extortion or sextortion scams, in which the sender claims to have access to your camera, microphone, photos, or browsing history and demands payment to keep the information private. In most cases, these claims are entirely fabricated.

Real Pegasus spyware infections are very different. Pegasus is an advanced spyware tool that has been used to target a small number of high-profile individuals, including journalists, activists, political figures, and suspected criminals. Rather than being spread via emails, Pegasus has historically been installed by exploiting security vulnerabilities, including sophisticated zero-click exploits that require little or no interaction from the victim.

If you receive an email claiming Pegasus spyware has infected your device, it’s almost certainly a form of extortion or sextortion scam — not evidence that your phone has actually been compromised.

What is Pegasus spyware?

Pegasus is one of the most sophisticated spyware tools ever developed. Created by the Israeli cyber-intelligence company NSO Group, it is marketed to government agencies for investigating serious crime and terrorism.

Pegasus is capable of stealthily and reliably exploiting security vulnerabilities to infect smartphones. Once installed, it can access messages, photos, emails, contacts, location data, and other sensitive information. Depending on the nature of the exploit and device type, it may also be able to activate the camera or microphone and monitor activity without the user's knowledge.

According to NSO Group, Pegasus is sold only to vetted government customers. However, investigations have found evidence that it has also been used to target journalists, activists, lawyers, political opponents, and other members of civil society, prompting widespread criticism and legal scrutiny.

What does a Pegasus email look like?

Although the format and wording vary, most Pegasus scam messages follow the same basic formula. Unlike real Pegasus infections, which are designed to remain hidden, they claim your device has been compromised, allege the sender has access to your private photos, messages, or browsing history, and threaten to release this information unless you pay a ransom — usually in cryptocurrency.

Below, we’ll break down the specific types of threats these scammers use and the telltale signs that the email in your inbox is, indeed, a scam.

The Pegasus spyware scam email

A Pegasus spyware scam email is usually a form of sextortion or other social engineering scam. The email, purportedly from an anonymous hacker, typically claims to have used Pegasus to gain access to your camera or microphone, and delivers threats such as these real-life examples:

• “Your device has been infected with Pegasus.”
• “I have access to your camera and recordings.”
• “I will release compromising footage unless you pay $1,000 in Bitcoin.”
• “Hello pervert, I installed Pegasus spyware on your computer, and I’ve recorded all sorts of ‘embarrassing’ videos of you.”

As part of this scam, the email typically claims the information will be shared with your family, colleagues, or posted on social media unless you pay up. The attacker may even include old photos or personal details to make the threat seem more convincing. However, these details are usually gathered from past data breaches or publicly available sources — not because Pegasus spyware is installed on your device.

Signs a Pegasus Spyware email is a scam

Many Pegasus scam emails follow the same playbook. Here are some of the most common warning signs to look for:

• Mentioning Pegasus by name: Pegasus is designed to operate covertly. An attacker genuinely deploying Pegasus would have little reason to reveal the spyware’s name in an email, making this one of the clearest signs of a scam.
• An email sent from your own address: Scammers often spoof the sender’s address to make it look like the email was sent from your own account. As detailed in this Reddit thread, this doesn’t necessarily mean your email has been hacked.
• Polished or AI-generated language: Modern scam emails often seem surprisingly well written and free of spelling mistakes. That’s because many scammers now use AI to produce professional-looking messages, so don’t assume an email is legitimate simply because it sounds polished.
• Blackmail or extortion threats: These emails often claim to have compromising photos, videos, or recordings and threaten to send them to your friends, family, or coworkers unless you pay a ransom.
• Personal information from past data breaches: Some scammers include details such as an old password, home address, or phone number to make their claims seem credible. In many cases, this information was obtained from previous data breaches, rather than spyware installed on your device.
• Urgent payment demands: Pegasus scam emails almost always use fear and urgency to pressure victims to pay quickly using cryptocurrency or another difficult-to-trace payment method.
• Generic or inaccurate claims: Because these campaigns are sent to thousands of people, the details are often vague or incorrect. For example, the email may accuse you of visiting websites you’ve never used or describe events that never happened.

The Pegasus spyware text message

Early Pegasus infections often relied on spear phishing, in which attackers sent carefully crafted SMS messages containing malicious links to specific individuals. Unlike mass phishing campaigns, spear phishing targets a particular person using messages designed to appear relevant or trustworthy.

When a victim clicked the link, they were redirected to an exploit server that attempted to compromise the device by taking advantage of unpatched security vulnerabilities. If successful, the exploit silently installed Pegasus spyware without requiring the user to download an app or approve any permissions.

For example, investigations by Forbidden Stories found that some targeted journalists received text messages about potential news tips or exclusive stories, along with a link promising more information. In reality, the link activated an exploit designed to install Pegasus on the victim's phone.

While such campaigns were common attack vectors for early iterations of Pegasus, later versions increasingly relied on sophisticated zero-click exploits, network injection attacks, and vulnerabilities in widely used messaging and communication apps, allowing infections to occur with little or no user interaction.

Targets of Pegasus spyware vs. Pegasus scam emails

Real Pegasus spyware targets are often high-profile individuals, such as suspected terrorists or criminals, or, in some cases, prominent activists, journalists, and politicians. Because Pegasus is an advanced and costly surveillance tool, its use is typically reserved for carefully selected individuals rather than the general public.

Pegasus email scams, by contrast, cast a much wider net. These messages are sent to thousands of people at a time and falsely claim that Pegasus has infected the recipient's device. Unlike genuine spyware operations, the emails openly mention Pegasus by name and demand payment — usually in cryptocurrency — ostensibly to prevent the release of supposed compromising information.

What should I do if I receive a Pegasus email?

If you receive an email claiming your device has been infected with Pegasus spyware, don’t panic. In almost every case, these messages are extortion scams rather than evidence of a genuine Pegasus infection.

Here’s what to do if you receive a Pegasus scam email:

• Do not reply: Avoid engaging with the sender, even if you’re tempted to challenge their claims. Responding confirms that your email address is active and may lead to further scam attempts.
• Do not pay: Pegasus scam emails are designed to pressure victims into sending money, usually through cryptocurrency or gift cards. Paying won't remove a nonexistent infection, and there's no guarantee the scammer will stop contacting you.
• Mark the email as spam: Report the message using your email provider's spam or phishing option. This helps improve spam filtering and may protect other users from similar scams.
• Delete the email: Once you've reported it, delete the message unless you need to keep it as evidence for your employer or law enforcement.
• Scan your device for malware: Run a full scan using reputable antivirus or anti-malware software to check for common threats. While standard security tools aren't designed to detect military-grade spyware like Pegasus, they can find and remove other forms of spyware or malware.
• Change your passwords if necessary: If the email contains an old password or you suspect one of your accounts has been compromised, change your passwords immediately and enable multi-factor authentication wherever possible.
• Keep your devices updated: Install the latest operating system and security updates. Software patches help protect against newly discovered vulnerabilities that attackers may try to exploit.
• Use specialized forensic tools: If you’re a journalist, activist, political figure, or another person who could realistically be targeted by Pegasus, consider using Amnesty International’s Mobile Verification Toolkit (MVT) or seeking assistance from a trusted cybersecurity professional. MVT is designed to detect forensic traces of Pegasus that conventional antivirus software may miss.

Protect your devices from spies and scammers

Pegasus is an exceptionally sophisticated spyware tool used in highly targeted attacks, but it’s unlikely to be a direct threat to most people’s privacy. Everyday spyware, ransomware, and other forms of malware are far more common — and can target anyone.

Norton 360 Deluxe helps protect against these evolving threats with real-time, heuristic malware protection, AI-powered scam detection, and advanced security features designed to stop attacks before they compromise your device or personal information. Stay one step ahead with protection built for today — and tomorrow.

FAQs

Is a Pegasus spyware email scam a type of phishing?

Not usually. Rather than tricking you into clicking a dangerous link, most Pegasus email scams are forms of extortion that falsely claim your device has been infected to pressure you into paying money. However, scammers may use information obtained through phishing attacks or past data breaches to make these emails appear more convincing.

How do I know if I’ve been hacked by Pegasus?

Unlike detecting regular spyware, there are no reliable signals that confirm a Pegasus infection. While unexplained device behavior can sometimes indicate that your phone’s been hacked, these issues can also result from normal software or hardware problems. And, because Pegasus is designed to operate covertly, confirming an infection typically requires specialized forensic analysis.

Can you get rid of the Pegasus virus?

Pegasus isn’t technically a virus, but an advanced spyware tool designed to evade detection by consumer-grade antivirus software. If you believe you've been targeted, update your device to the latest software version and seek expert assistance. In the case of a confirmed Pegasus infection, security professionals recommend replacing the device and changing passwords and account credentials to ensure the compromise has been fully addressed.

How do I know if someone is monitoring my phone?

A monitored phone may exhibit unusual behavior, such as excessive battery drain, unexplained data usage, poor performance, overheating, or unfamiliar apps and settings changes. However, none of these symptoms prove your phone is tapped, as they can also be caused by legitimate software issues or aging hardware.

How to know if a sextortion email is real?

Pegasus sextortion scams are common, but the vast majority are fraudulent. These emails often demand payment in Bitcoin and include old passwords or publicly available information to make the threat seem credible. However, if a message contains genuine, recent intimate images or videos that weren't publicly available, treat it as a real incident rather than a scam and contact law enforcement immediately.