Cyber Geeks finished their analysis of the Pegasus spyware for Android with a third part covering MQTT command and control, email theft, location tracking and an MP3 file played through MediaPlayer that the author believes exploited a vulnerability.
The Android version was originally documented by Lookout, which had attributed Pegasus to NSO Group together with Citizen Lab.
Google’s Android security team tracks the same malware as Chrysaor and counted fewer than three dozen installs on victim devices, with a superuser binary at /system/csk as the fallback when the framaroot exploits failed.
Rare enough that almost nobody ever saw it, which is rather the point.
