{
  "id": 184,
  "slug": "2017-mexico-aristegui-pegasus-spyware",
  "title": "Mexico: journalist Carmen Aristegui receives Pegasus spyware through phishing texts",
  "occurred_on": "2017-06-19",
  "occurred_on_precision": "day",
  "ended_on": null,
  "jurisdiction": "MX",
  "country": "MX",
  "continent": "north-america",
  "level": "national",
  "type": null,
  "tactic_primary": "surveillance_and_subpoenas",
  "leader_slug": "enrique-pena-nieto",
  "issue_of_the_day": "Aristegui and Loret de Mola were among several Mexican investigative journalists, human rights defenders and anti-corruption figures sent the same spyware technique around the same period.",
  "outcome": "unknown",
  "outcome_on": "2017-06-20",
  "outcome_note": "The government denied responsibility and Citizen Lab's report found no conclusive evidence establishing who sent the spyware, according to the source reviewed.",
  "granularity": "granular",
  "era": "2010s",
  "summary": "Citizen Lab, R3D and Article 19 documented Pegasus spyware sent to Mexican investigative journalists Carmen Aristegui and Carlos Loret de Mola through phishing text messages, which the Mexican government denied having sent.{c:623}{c:624}{c:625}",
  "what_happened": "On June 19 and 20, 2017, researchers at Citizen Lab, a University of Toronto research group, working with the Mexican digital rights organization R3D and the press freedom group Article 19, documented that investigative journalists Carmen Aristegui and Carlos Loret de Mola, along with several human rights defenders and anti-corruption figures, had received phishing text messages containing fabricated warnings about family members. Clicking the links in the messages installed Pegasus spyware, made by the Israeli firm NSO Group, on the recipients' phones. NSO Group has said it sells Pegasus exclusively to governments. President Enrique Pena Nieto's administration categorically denied that any of its members engaged in surveillance or communications operations against human rights defenders, journalists or anti-corruption activists without prior judicial authorization. Citizen Lab's report said the spyware itself could not be traced back to whoever had sent it, and that there was no conclusive evidence establishing who was responsible.{c:623}{c:624}{c:625}\n\nNo individual or agency was conclusively identified as responsible in the source reviewed, and the government denied involvement.{c:625}",
  "stated_justification": "President Enrique Pena Nieto's administration \"categorically denie[d] that any of its members engages in surveillance or communications operations against defenders of human rights, journalists, anti-corruption activists or any other person without prior judicial authorization.\"{c:624}",
  "effect_on_reporting": "Prominent investigative journalists covering corruption and human rights in Mexico received spyware capable of reading their phones' communications, while the technical evidence could not conclusively identify who was responsible.{c:623}{c:624}{c:625}",
  "unknowns": "Citizen Lab's report states there was no conclusive evidence establishing who was responsible, and the source reviewed does not report that this was later resolved.",
  "status": "in_effect",
  "status_updated_on": "2026-09-22",
  "external_ids": {},
  "illustration_key": null,
  "pub_state": "published",
  "published_at": "2026-09-23T01:33:19Z",
  "reviewed_on": "2026-09-22",
  "next_review_on": "2026-12-22",
  "revision": 5,
  "created_at": "2026-09-23T01:33:14Z",
  "updated_at": "2026-09-23T02:21:26Z",
  "stage": "punish",
  "ladder_note": "Investigative journalists' phones were secretly infected with spyware through fabricated personal warnings, with government responsibility denied and never conclusively established.",
  "country_name": "Mexico",
  "tactics": [
    "surveillance_and_subpoenas"
  ],
  "leader": {
    "slug": "enrique-pena-nieto",
    "name": "Enrique Pena Nieto",
    "url": "https://thewaronnews.com/leaders/enrique-pena-nieto"
  },
  "url": "https://thewaronnews.com/incidents/2017-mexico-aristegui-pegasus-spyware",
  "page_meta": {
    "published": "2026-09-23T01:33:19Z",
    "reviewed": "2026-09-22",
    "sources": 2,
    "status": "in_effect",
    "statusAsOf": "2026-09-22",
    "unknowns": "Citizen Lab's report states there was no conclusive evidence establishing who was responsible, and the source reviewed does not report that this was later resolved."
  },
  "actors": [
    {
      "slug": "enrique-pena-nieto",
      "name": "Enrique Pena Nieto",
      "kind": "person",
      "role": "other",
      "role_at_time": null,
      "url": "https://thewaronnews.com/actors/enrique-pena-nieto"
    }
  ],
  "outlets": [
    {
      "slug": "aristegui-noticias",
      "name": "Aristegui Noticias",
      "relation": "affected",
      "url": "https://thewaronnews.com/outlets/aristegui-noticias"
    }
  ],
  "journalists": [
    {
      "slug": "carlos-loret-de-mola",
      "name": "Carlos Loret de Mola",
      "outlet": null,
      "relation": "affected",
      "url": "https://thewaronnews.com/journalists/carlos-loret-de-mola"
    },
    {
      "slug": "carmen-aristegui",
      "name": "Carmen Aristegui",
      "outlet": "aristegui-noticias",
      "relation": "affected",
      "url": "https://thewaronnews.com/journalists/carmen-aristegui"
    }
  ],
  "cases": [],
  "related": [],
  "events": [],
  "claims": [
    {
      "id": 623,
      "subject_type": "incident",
      "subject_id": 184,
      "field": "action",
      "value": "phishing texts, June 19-20, 2017",
      "statement": "Citizen Lab, R3D and Article 19 documented that Aristegui and Loret de Mola received phishing texts with fabricated family warnings that installed Pegasus spyware.",
      "attribution": null,
      "source_id": 372,
      "evidence_quote": "Investigative journalists Carmen Aristegui and Carlos Loret de Mola, along with human rights activists and anti-corruption figures.",
      "evidence_date": "2017-06-20",
      "method": "outlet_report",
      "verified_at": "2026-09-22",
      "confidence": "medium",
      "status": "current",
      "supersedes_id": null,
      "superseded_by": null,
      "supersede_reason": null,
      "batch_label": "seed-2026-09-22",
      "created_at": "2026-09-23T01:33:17Z",
      "source": {
        "id": 372,
        "url": "https://cpj.org/2017/06/spyware-targeted-mexican-journalists-and-activists/",
        "final_url": "https://cpj.org/2017/06/spyware-targeted-mexican-journalists-and-activists/",
        "title": "Spyware targeted Mexican journalists and activists",
        "publisher": "Committee to Protect Journalists",
        "published_on": "2017-06-20",
        "link_state": "live",
        "link_state_since": "2026-09-22T12:00:00Z",
        "wayback_url": null,
        "wayback_saved_at": null
      },
      "url": "https://thewaronnews.com/claims/623"
    },
    {
      "id": 624,
      "subject_type": "incident",
      "subject_id": 184,
      "field": "stated_justification",
      "value": "government denial",
      "statement": "President Pena Nieto's administration denied that any of its members conducted surveillance against journalists or human rights defenders without judicial authorization.",
      "attribution": null,
      "source_id": 372,
      "evidence_quote": "categorically denie[d] that any of its members engages in surveillance or communications operations against defenders of human rights, journalists, anti-corruption activists or any other person without prior judicial authorization",
      "evidence_date": "2017-06-20",
      "method": "outlet_report",
      "verified_at": "2026-09-22",
      "confidence": "medium",
      "status": "current",
      "supersedes_id": null,
      "superseded_by": null,
      "supersede_reason": null,
      "batch_label": "seed-2026-09-22",
      "created_at": "2026-09-23T01:33:17Z",
      "source": {
        "id": 372,
        "url": "https://cpj.org/2017/06/spyware-targeted-mexican-journalists-and-activists/",
        "final_url": "https://cpj.org/2017/06/spyware-targeted-mexican-journalists-and-activists/",
        "title": "Spyware targeted Mexican journalists and activists",
        "publisher": "Committee to Protect Journalists",
        "published_on": "2017-06-20",
        "link_state": "live",
        "link_state_since": "2026-09-22T12:00:00Z",
        "wayback_url": null,
        "wayback_saved_at": null
      },
      "url": "https://thewaronnews.com/claims/624"
    },
    {
      "id": 625,
      "subject_type": "incident",
      "subject_id": 184,
      "field": "status",
      "value": "no conclusive attribution",
      "statement": "Citizen Lab's report said the spyware could not be traced back to its senders and there was no conclusive evidence of who was behind the attacks.",
      "attribution": null,
      "source_id": 372,
      "evidence_quote": "the software cannot be traced back to its original senders",
      "evidence_date": "2017-06-20",
      "method": "outlet_report",
      "verified_at": "2026-09-22",
      "confidence": "medium",
      "status": "current",
      "supersedes_id": null,
      "superseded_by": null,
      "supersede_reason": null,
      "batch_label": "seed-2026-09-22",
      "created_at": "2026-09-23T01:33:18Z",
      "source": {
        "id": 372,
        "url": "https://cpj.org/2017/06/spyware-targeted-mexican-journalists-and-activists/",
        "final_url": "https://cpj.org/2017/06/spyware-targeted-mexican-journalists-and-activists/",
        "title": "Spyware targeted Mexican journalists and activists",
        "publisher": "Committee to Protect Journalists",
        "published_on": "2017-06-20",
        "link_state": "live",
        "link_state_since": "2026-09-22T12:00:00Z",
        "wayback_url": null,
        "wayback_saved_at": null
      },
      "url": "https://thewaronnews.com/claims/625"
    }
  ],
  "sources": [
    {
      "id": 372,
      "url": "https://cpj.org/2017/06/spyware-targeted-mexican-journalists-and-activists/",
      "final_url": "https://cpj.org/2017/06/spyware-targeted-mexican-journalists-and-activists/",
      "title": "Spyware targeted Mexican journalists and activists",
      "publisher": "Committee to Protect Journalists",
      "published_on": "2017-06-20",
      "link_state": "live",
      "link_state_since": "2026-09-22T12:00:00Z",
      "wayback_url": null,
      "wayback_saved_at": null
    },
    {
      "id": 448,
      "url": "https://www.reuters.com/article/world/activists-and-journalists-in-mexico-complain-of-government-spying-idUSKBN19A312/",
      "final_url": "https://www.reuters.com/article/world/activists-and-journalists-in-mexico-complain-of-government-spying-idUSKBN19A312/",
      "title": "Activists and journalists in Mexico complain of government spying",
      "publisher": "Reuters",
      "published_on": "2017-06-19",
      "link_state": "paywalled",
      "link_state_since": "2026-09-23T02:35:35Z",
      "wayback_url": null,
      "wayback_saved_at": null
    }
  ],
  "revisions_url": "https://thewaronnews.com/incidents/2017-mexico-aristegui-pegasus-spyware/revisions",
  "license": {
    "name": "CC BY 4.0",
    "url": "https://creativecommons.org/licenses/by/4.0/"
  },
  "cite_as": "Mexico: journalist Carmen Aristegui receives Pegasus spyware through phishing texts. The War On News, thewaronnews.com. https://thewaronnews.com/incidents/2017-mexico-aristegui-pegasus-spyware. Retrieved 2026-09-23."
}