A spying scandal in Mexico widened Thursday after it was confirmed by experts that several of the country’s top opposition leaders — along with journalists and human rights advocates — were targeted by high-tech spyware exclusively sold to governments.
The Internet watchdog group Citizen Lab exposed the scandal this month in a report that showed that spyware known as Pegasus had been used in recent years to infiltrate the cellphones of 12 prominent journalists and rights activists, all of whom had been critical of the Mexican government.
The victims received messages with links to the same malware, which, when activated, allows outsiders to remotely access a phone’s data as well as activate its camera and microphone.
On Thursday, the group said the spyware had been used against members of the conservative National Action Party, or PAN, which had asked Citizen Lab to investigate suspicious messages received by several of top members. Although Citizen Lab did not say who it believes was responsible for the spying, the group said that around the time the victims’ phones were targeted, Congress was debating anti-corrpution legislation.
In its first report, Citizen Lab said those who had been sent the link to the malware were all government critics. Among them was the prominent investigative journalist Carmen Aristegui, who led a team in 2014 that reported the wife of Mexican President Enrique Peña Nieto had benefited from a real estate deal with a builder who had received some of the country’s top construction contracts.
NSO Group, the Israeli company that makes the spyware, says it sells its product only to government agencies for the purpose of fighting criminals and terrorists.
Last week, Peña Nieto acknowledged that Mexico had purchased the spyware, but he denied the government had ordered the surveillance. He promised an investigation into who was behind what may be the biggest domestic espionage scandal in Mexico’s history.
The emails with links to the malware included messages designed to trick the recipients into opening the attachments.
“Senator, my friend, my husband just died,” said one Pegasus message sent to PAN Sen. Roberto Gil Zuarth. “I am sending you information about the wake.” The link actually enabled a download for the malware.
“Good morning President,” said another message, sent to PAN leader Ricardo Anaya. “I’m sharing this report … about you that is going viral.”
Anaya said at a news conference this month that none of the PAN members clicked on the links because they found them suspicious.