Citizen Lab said at last 10 Pegasus operators appeared to be carrying out cross-border surveillance operations. There are versions of the spyware for both major mobile operating systems, iOS and Android. 

The group said it had scanned the Internet for servers associated with the spyware between August 2016 and August 2018.

"We found 1091 IP addresses that matched our fingerprint and 1014 domain names that pointed to them, Bill Marczak, John Scott-Railton, Sarah McKune, Bahr Abdul Razzak, and Ron Deibert said in a blog post.

The five researchers said they had designed and conducted a DNS cache probing study to find out the countries in which each operator was spying.

" Our technique identified a total of 45 countries where Pegasus operators may be conducting surveillance operations. At least 10 Pegasus operators appear to be actively engaged in cross-border surveillance," they wrote.

The spread of the use of Pegasus did not mean an improvement for human rights in countries where it was in use, The Citizen Lab said.

"At least six countries with significant Pegasus operations have previously been linked to abusive use of spyware to target civil society, including Bahrain, Kazakhstan, Mexico, Morocco, Saudi Arabia, and the United Arab Emirates," the researchers wrote.

The range of information gathered from a device infected with Pegasus.

"Pegasus also appears to be in use by countries with dubious human rights records and histories of abusive behaviour by state security services.

"In addition, we have found indications of possible political themes within targeting materials in several countries, casting doubt on whether the technology is being used as part of 'legitimate' criminal investigations."

They said they had found a suspected Pegasus presence in 45 countries: Algeria, Bahrain, Bangladesh, Brazil, Canada, Cote d’Ivoire, Egypt, France, Greece, India, Iraq, Israel, Jordan, Kazakhstan, Kenya, Kuwait, Kyrgyzstan, Latvia, Lebanon, Libya, Mexico, Morocco, the Netherlands, the Sultanate of Oman, Pakistan, Palestine, Poland, Qatar, Rwanda, Saudi Arabia, Singapore, South Africa, Switzerland, Tajikistan, Thailand, Togo, Tunisia, Turkey, the UAE, Uganda, the United Kingdom, the United States, Uzbekistan, Yemen, and Zambia.

Graphics: courtesy The Citizen Lab