Exploit archaeology: a forensic history of in-the-wild NSO Group exploits

This forensic report documents NSO Group's long-running use of zero-click and one-click exploits to deploy Pegasus spyware against civil-society targets from 2017–2021, identifying six distinct iOS zero-click chains (including ForcedEntry/Megalodon) and an Android WhatsApp exploit, providing technical artifacts, timelines, and indicators useful for detection and attribution.