Pegasus, Predator, Graphite and modern mobile spyware
A field guide to the spyware families SmartScan is built to detect through network behaviour and forensic indicators.
Scan for spyware indicatorsPegasus by NSO Group
Pegasus is associated with zero-click exploitation, iMessage and WhatsApp attack chains, and high-value targeting of journalists, lawyers and civil society. Network indicators may include suspicious C2 domains, TLS fingerprints and direct IP traffic.
Predator by Intellexa/Cytrox
Predator campaigns have targeted politicians, officials and journalists. It is often discussed alongside exploit chains, infection links and persistent mobile surveillance infrastructure.
Graphite by Paragon
Graphite is a newer surveillance implant category linked to sophisticated targeting and messaging-app attack surfaces. It is designed to evade consumer security products.
Candiru, Hermit, FinSpy and commercial spyware
The spyware market includes both state-level and commercial tools. SmartScan tracks broad classes of surveillance infrastructure, stalkerware, MDM abuse and covert channels.