CyberPhone — Pegasus vs. Hardware Spy Phones: A Technical Comparison

Pegasus, developed by the NSO Group, is the archetypal software-only intelligence platform. It is delivered to a target device as a payload that exploits one or more zero-day vulnerabilities in the operating system or a system app, gains execution, establishes persistence, and then exfiltrates data over the device's normal network interfaces. Its entire lifecycle occurs within the software domain that the operating system controls.

A hardware-modified spy phone inverts the model. The surveillance capability is not delivered to the device at all — it is built into the device at the hardware level before the target ever receives it. There is no exploit, no payload, and no software artifact on the operating system. The comparison, therefore, is not between two delivery methods but between a transient software capability and a permanent hardware capability.

Pegasus delivery depends on a live, unpatched vulnerability. The FORCEDENTRY vector (CVE-2021-30860) exploited a logic flaw in CoreGraphics' PDF parser via iMessage; the target needed only to receive the message. But once Apple issued iOS 14.8, that specific vector closed permanently. Every Pegasus deployment is a depreciating asset tied to a patchable flaw.

A hardware spy phone requires no delivery exploit because the capability is preinstalled. The only delivery step is placing the physical device into the target's hands — typically through a device-issuance, gifting, or replacement scenario. There is no zero-day to burn, no message to send, and no interaction required from the target. The attack surface, in the traditional sense, is zero.

Software spyware persists by writing itself to a location the operating system will re-execute on boot — a daemon, a kernel module, or a bootloader hook. A factory reset, which wipes the user data partition and reinstalls a clean OS image, removes all of these persistence mechanisms. Pegasus installations do not survive a factory reset; the operator must re-exploit the device.

A hardware-modified device survives every software-level reset. The surveillance coprocessor's firmware resides in flash that is not addressable by the Android recovery or bootloader, so a factory reset, an OTA OS update, a side-loaded firmware flash, or even a full device wipe leaves the coprocessor intact. The capability persists for the physical lifetime of the phone.

This has direct operational consequences: a hardware-modified device remains viable across years of OS updates, while a Pegasus deployment may be neutralized by a single Tuesday patch.

Because Pegasus runs as software on the application processor, it leaves forensic artifacts: suspicious processes, unexpected files in system directories, anomalous network connections, and modifications to the dyld shared cache or kernel structures. Mobile forensic suites such as Cellebrite UFED and Magnet AXIOM, and researchers' tools like MVT (Mobile Verification Toolkit), are explicitly designed to detect these artifacts.

A hardware-modified device produces none of these artifacts because no surveillance software runs on the application processor. The coprocessor is invisible to the OS device tree, has no representation in process or network listings, and stores its data in flash that forensic tools do not image or parse. Standard mobile forensic acquisition — which captures the Android file system and memory — will return a clean device with no indicators of compromise.

Detection of a hardware modification requires physical teardown and board-level analysis, a capability available to very few laboratories and essentially never performed in routine device inspections.

The economic profile of the two approaches diverges sharply over time. A Pegasus license is a recurring expense — NSO Group licensing is reported in the hundreds of thousands of dollars per target, and each exploit refresh after a vendor patch represents additional cost. The capability's useful lifetime is bounded by the vendor patch cadence.

A hardware-modified device is a one-time capital purchase whose surveillance capability does not depreciate with OS updates. The per-target cost amortizes over years of operation, and there is no ongoing exploit-development expense. For sustained, multi-year monitoring of issued devices, the hardware model is both more reliable and more cost-effective.

CyberPhone has no affiliation, licensing, or technical relationship with the NSO Group or its Pegasus product. This whitepaper references Pegasus solely for comparative technical analysis. CyberPhone's hardware-modified approach is an independent engineering effort, and the company does not acquire, resell, or rely upon NSO Group software or exploits.