Magic Lantern DEVELOPED_BY Jack Rhysider
Jack discusses Magic Lantern and its reported use by the FBI.
Explicit Confidence 98% · Jack Rhysider EP 100 Details
“There’s this malware called Magic Lantern and I find it fascinating.”
Episode
31 August 2021 Official episode · Official transcript
advanced persistent threat
The episode examines NSO Group’s Pegasus mobile spyware, its exploit chains, investigations by Citizen Lab and other researchers, alleged misuse by governments, and legal and accountability disputes.
Topics: Mobile spyware and government surveillance, Pegasus exploit chains against iPhones, WebKit exploitation, Remote iPhone jailbreaking, Kernel zero-days, Zero-click exploitation of WhatsApp, Phishing and social engineering, Spyware command-and-control infrastructure, Encrypted traffic interception and man-in-the-middle testing, WHOIS and reverse-DNS infrastructure attribution, HLR phone-number lookup, Mobile device forensic analysis, Targeted surveillance of journalists and civil society, Exploit-as-a-service and spyware licensing models, Spyware abuse, oversight, and accountability
Links published on the Darknet Diaries episode page. Not LLM output.
Qualified statements from this episode, not graph facts.
Magic Lantern DEVELOPED_BY Jack Rhysider
Jack discusses Magic Lantern and its reported use by the FBI.
Explicit Confidence 98% · Jack Rhysider EP 100 Details
“There’s this malware called Magic Lantern and I find it fascinating.”
FBI USES Magic Lantern
According to information obtained through a Freedom of Information request, the FBI used Magic Lantern to capture keystrokes on target computers.
Attributed Confidence 97% · Jack Rhysider EP 100 Details
“the FBI uses this Magic Lantern malware to capture keystrokes on target computers”
Magic Lantern ASSOCIATED_WITH lawful intercept
Jack says Magic Lantern would be classified as a lawful intercept mechanism if the FBI had legal permission to use it.
Uncertain Confidence 91% · Jack Rhysider EP 100 Details
“this would classify Magic Lantern to be a lawful intercept mechanism”
John Scott-Railton MEMBER_OF Citizen Lab
John identifies himself as a senior researcher at Citizen Lab.
Explicit Confidence 99% · John Scott-Railton EP 100 Details
“I’m a senior researcher at the Citizen Lab”
Citizen Lab PART_OF University of Toronto’s Munk School
John describes Citizen Lab in connection with the University of Toronto’s Munk School.
Derived Confidence 88% · John Scott-Railton EP 100 Details
“at the Citizen Lab at the University of Toronto’s Munk School”
FinFisher TARGETS Ahmed Mansoor
John says Ahmed Mansoor was targeted in 2011 by an email containing FinFisher.
Explicit Confidence 98% · John Scott-Railton EP 100 Details
“in 2011 Mansoor was targeted by an e-mail with a Trojan that was FinFisher”
Pegasus DISCOVERED_BY Citizen Lab
Citizen Lab discovered and obtained a copy of Pegasus while investigating links sent to Ahmed Mansoor.
Explicit Confidence 96% · John Scott-Railton EP 100 Details
“we were actually able to grab the payload, the actual Pegasus deployment”
Pegasus DISCOVERED_BY Lookout Security
Lookout Security worked with Citizen Lab to investigate and dissect the newly discovered Pegasus malware.
Explicit Confidence 93% · Jack Rhysider EP 100 Details
“they teamed up with Lookout Security to help investigate this”
Pegasus USES zero-day exploit chain
Pegasus used a chain of previously unknown exploits against mobile devices.
Explicit Confidence 98% · John Scott-Railton EP 100 Details
“it’s using this chain of zero-days”
Pegasus USES remote jailbreak
The Pegasus infection remotely jailbroke the test iPhone.
Explicit Confidence 99% · John Scott-Railton EP 100 Details
“we had just observed a remote jailbreak on this iPhone”
zero-day exploit chain AFFECTS WebKit
The first stage of the exploit chain targeted a bug in WebKit.
Explicit Confidence 98% · Jack Rhysider EP 100 Details
“That JavaScript program tries to exploit a bug in WebKit”
zero-day exploit chain AFFECTS iPhone
The exploit chain was used against fully patched iPhones and included kernel exploits that enabled jailbreaking.
Explicit Confidence 97% · Jack Rhysider EP 100 Details
“this worked with iPhones which were fully patched”
Pegasus could read WhatsApp messages from an infected phone.
Explicit Confidence 97% · Jack Rhysider EP 100 Details
“read WhatsApp messages or listen to calls or track location”
Pegasus DEVELOPED_BY NSO Group
The episode presents Pegasus as the flagship spyware made and sold by NSO Group.
Explicit Confidence 99% · Jack Rhysider EP 100 Details
“It’s the flag ship software that NSO sells”
Shalev Hulio MEMBER_OF NSO Group
Shalev Hulio is identified as one of the founders of NSO and as the company’s S.
Explicit Confidence 98% · Jack Rhysider EP 100 Details
“That’s Shalev Hulio, the S in NSO”
Omri is identified as one of the founders of NSO and as the O in its name.
Explicit Confidence 96% · Jack Rhysider EP 100 Details
“I reached out to NSO first with Omri who’s the O part of NSO”
The episode says the Mexican government purchased Pegasus and that Mexican government or affiliated operators controlled it.
Explicit Confidence 98% · Jack Rhysider EP 100 Details
“NSO sold the tool to the Mexican government and from there, it’s now someone within the Mexican government or affiliated organization who has control of it”
Saudi Arabia USES Pegasus
Jack says NSO sold Pegasus to the Saudi government, while the episode also presents uncertainty about its use against Khashoggi and his associates.
Explicit Confidence 96% · Jack Rhysider EP 100 Details
“NSO has also sold their spyware to the government of Saudi Arabia”
Pegasus ASSOCIATED_WITH Jamal Khashoggi
The episode presents a theory that Saudi operators may have used Pegasus to spy on Khashoggi, but says his phone was not recovered and the claim is not certain.
Uncertain Confidence 82% · Jack Rhysider EP 100 Details
“the theory is that the Saudi government used Pegasus to spy on Khashoggi”
zero-click exploit AFFECTS WhatsApp
Citizen Lab found a zero-click exploit targeting WhatsApp users, after which WhatsApp patched the application.
Explicit Confidence 98% · John Scott-Railton EP 100 Details
“he was targeted with what we now know to have been a zero-click exploit against WhatsApp users”
Pegasus USES zero-click exploit
The episode says NSO sold a zero-click WhatsApp exploit to customers as a way to deploy Pegasus without requiring the victim to click.
Explicit Confidence 96% · Jack Rhysider EP 100 Details
“NSO was in fact selling this exploit to its customers”
WhatsApp v. NSO Group litigation INVOLVES NSO Group
WhatsApp sued NSO over exploitation of WhatsApp users; the episode describes the litigation as ongoing at the time of recording.
Explicit Confidence 99% · John Scott-Railton EP 100 Details
“Since the time of that initial discovery, WhatsApp has sued NSO”
WhatsApp v. NSO Group litigation INVOLVES Pegasus
The WhatsApp litigation concerns the exploitation of users with Pegasus spyware.
Explicit Confidence 96% · Peter Dobbie EP 100 Details
“NSO has faced a number of lawsuits, one of them from WhatsApp”
“victims of Pegasus spyware”
John Scott-Railton TARGETS Black Cube
John and Jack state that Black Cube spies targeted John Scott-Railton in connection with Citizen Lab’s work on NSO.
Explicit Confidence 97% · Jack Rhysider EP 100 Details
“Black Cube spying on John Scott-Railton and Citizen Lab”
According to a Reuters article by Joseph Menn, the FBI was trying to determine whether NSO obtained exploits from Americans; Jack also speculates that the FBI may be investigating NSO more broadly.
Attributed Confidence 88% · Jack Rhysider EP 100 Details
“Joseph Menn at Reuters wrote an article saying that the FBI was trying to determine if the NSO Group got any of its exploits from Americans”
Works mentioned in the transcript. Distinct from show-note sources.
Model gpt-5.6-luna · prompt 1.5.19 · schema 1.5.19 · 2026-09-13T07:15:24.822394+00:00