# Mexico: journalist Carmen Aristegui receives Pegasus spyware through phishing texts

Published 2026-09-23. Last reviewed 2026-09-22. 2 sources.

Status: in effect, as of 2026-09-22.

What we don't know: Citizen Lab's report states there was no conclusive evidence establishing who was responsible, and the source reviewed does not report that this was later resolved.

Citizen Lab, R3D and Article 19 documented Pegasus spyware sent to Mexican investigative journalists Carmen Aristegui and Carlos Loret de Mola through phishing text messages, which the Mexican government denied having sent.[1][2][3]

- Country: [Mexico](https://thewaronnews.com/countries/mx)
- Where: MX
- Level of government: National
- Tactic: Surveillance and subpoenas
- Stage: Punish (ladder: https://thewaronnews.com/ladders/surveillance_and_subpoenas#stage-punish)
- Ladder note: Investigative journalists' phones were secretly infected with spyware through fabricated personal warnings, with government responsibility denied and never conclusively established.
- Head of government at the time: [Enrique Pena Nieto](https://thewaronnews.com/leaders/enrique-pena-nieto)
- Issue of the day: Aristegui and Loret de Mola were among several Mexican investigative journalists, human rights defenders and anti-corruption figures sent the same spyware technique around the same period.
- Outcome: Unknown, June 20, 2017. The government denied responsibility and Citizen Lab's report found no conclusive evidence establishing who sent the spyware, according to the source reviewed.
- Era: The 2010s

## What happened

On June 19 and 20, 2017, researchers at Citizen Lab, a University of Toronto research group, working with the Mexican digital rights organization R3D and the press freedom group Article 19, documented that investigative journalists Carmen Aristegui and Carlos Loret de Mola, along with several human rights defenders and anti-corruption figures, had received phishing text messages containing fabricated warnings about family members. Clicking the links in the messages installed Pegasus spyware, made by the Israeli firm NSO Group, on the recipients' phones. NSO Group has said it sells Pegasus exclusively to governments. President Enrique Pena Nieto's administration categorically denied that any of its members engaged in surveillance or communications operations against human rights defenders, journalists or anti-corruption activists without prior judicial authorization. Citizen Lab's report said the spyware itself could not be traced back to whoever had sent it, and that there was no conclusive evidence establishing who was responsible.[1][2][3]

No individual or agency was conclusively identified as responsible in the source reviewed, and the government denied involvement.[3]

## What reason was given

President Enrique Pena Nieto's administration "categorically denie[d] that any of its members engages in surveillance or communications operations against defenders of human rights, journalists, anti-corruption activists or any other person without prior judicial authorization."[2]

## What changed for reporting

Prominent investigative journalists covering corruption and human rights in Mexico received spyware capable of reading their phones' communications, while the technical evidence could not conclusively identify who was responsible.[1][2][3]

## Timeline

- 2017-06-19: Mexico: journalist Carmen Aristegui receives Pegasus spyware through phishing texts

## Who acted

| Name | Role in this incident | Office at the time |
| --- | --- | --- |
| [Enrique Pena Nieto](https://thewaronnews.com/actors/enrique-pena-nieto) | other | President of Mexico |

## Outlets and journalists

| Name | Kind | Relation |
| --- | --- | --- |
| [Aristegui Noticias](https://thewaronnews.com/outlets/aristegui-noticias) | outlet | affected |
| [Carlos Loret de Mola](https://thewaronnews.com/journalists/carlos-loret-de-mola) | journalist | affected |
| [Carmen Aristegui](https://thewaronnews.com/journalists/carmen-aristegui) | journalist, Aristegui Noticias | affected |

## Sources

1. Spyware targeted Mexican journalists and activists. https://cpj.org/2017/06/spyware-targeted-mexican-journalists-and-activists/ (Committee to Protect Journalists, 2017-06-20).
2. Activists and journalists in Mexico complain of government spying. https://www.reuters.com/article/world/activists-and-journalists-in-mexico-complain-of-government-spying-idUSKBN19A312/ (Reuters, 2017-06-19).

## Claims cited

[1] Citizen Lab, R3D and Article 19 documented that Aristegui and Loret de Mola received phishing texts with fabricated family warnings that installed Pegasus spyware. Quote: "Investigative journalists Carmen Aristegui and Carlos Loret de Mola, along with human rights activists and anti-corruption figures." Source: Committee to Protect Journalists, 2017-06-20. Spyware targeted Mexican journalists and activists. https://cpj.org/2017/06/spyware-targeted-mexican-journalists-and-activists/ Claim: https://thewaronnews.com/claims/623, checked 2026-09-22.

[2] President Pena Nieto's administration denied that any of its members conducted surveillance against journalists or human rights defenders without judicial authorization. Quote: "categorically denie[d] that any of its members engages in surveillance or communications operations against defenders of human rights, journalists, anti-corruption activists or any other person without prior judicial authorization" Source: Committee to Protect Journalists, 2017-06-20. Spyware targeted Mexican journalists and activists. https://cpj.org/2017/06/spyware-targeted-mexican-journalists-and-activists/ Claim: https://thewaronnews.com/claims/624, checked 2026-09-22.

[3] Citizen Lab's report said the spyware could not be traced back to its senders and there was no conclusive evidence of who was behind the attacks. Quote: "the software cannot be traced back to its original senders" Source: Committee to Protect Journalists, 2017-06-20. Spyware targeted Mexican journalists and activists. https://cpj.org/2017/06/spyware-targeted-mexican-journalists-and-activists/ Claim: https://thewaronnews.com/claims/625, checked 2026-09-22.

Source page: https://thewaronnews.com/incidents/2017-mexico-aristegui-pegasus-spyware. The War On News, CC BY 4.0.