Warnings that recently arrived on two opposition leaders’ iPhones have brought the spectre of Pegasus spyware back into Thai politics.
Opposition leader Natthaphong Ruengpanyawut from the People’s Party and Democrat Party leader and former prime minister Abhisit Vejjajiva confirmed on November 3 they had received security alerts from Apple Inc.
The language of the “threat notification” was stark: “Apple detected that you are being targeted by a mercenary spyware attack that is trying to remotely compromise the iPhone associated with your Apple account.”
The warning also said: “This attack is likely targeting you specifically because of who you are or what you do. Attackers may be attempting to access sensitive information such as passwords, messages, and contacts, as well as your device camera and microphone.”
‘Extreme coincidence’
The spyware attacks come as Natthaphong and Abhisit prepare to scrutinise the government during next month’s no-confidence debate, which will target 18 Cabinet members, all from the ruling Bhumjaithai Party.
Natthaphong described the timing as a “really extreme coincidence”, noting that the attacks occurred after the censure debate was postponed from late October to early December. Abhisit also questioned the timing, saying he had been told that the spyware belonged to the “Pegasus family”, which is often used by state agencies.
MP Pawoot Pongvitayapanu from the opposition People’s Party noted that Thai authorities have a history of using Pegasus.
He said the Narcotics Suppression Bureau (NSB) purchased Pegasus software in 2014 for 247.5 million baht to support its investigations, but stopped using it in 2020 after maintenance funds ran out.
He added that the NSB asked for another 350 million baht to acquire an intelligence system similar to Pegasus in 2023, but the request was rejected by the House budget committee.
Pawoot also cited Pegasus attacks on more than 30 Thai activists and government critics in 2021 and 2022. But he stopped short of blaming the latest attacks on the current administration.
“I am not accusing the government of ordering the hacking of opposition politicians’ phones, as there is no evidence yet. But given that the Thai state did purchase this tool, and the leaders of two opposition parties have now received spyware warnings, the government must provide clear answers,” he said.
Government officials were quick to deny any involvement in spyware attacks on the opposition. Digital Economy and Society Minister Chaichanok Chidchob noted that Apple recently sent similar alerts to users across dozens of countries.
Meanwhile, Defence Ministry spokesman Rear Admiral Surasant Kongsiri maintained that the Thai military does not use Pegasus spyware and has no reason to acquire it.
Worldwide alerts
Tech media reported that Apple sent the latest batch of threat notifications in late October after detecting fresh mercenary spyware attacks affecting users in 99 countries.
Two years ago, the tech giant notified users in over 150 different countries that they had been targeted by “mercenary spyware” attacks – typically directed at high-profile individuals including politicians and activists.
Apple did not identify the spyware or the attackers involved, but media reports pointed fingers at Pegasus, surveillance software made by the Israeli cybersecurity company NSO Group.
Sales of the military-grade spyware to foreign states require approval from the Israeli government.
Pegasus grants attackers complete control over the targeted phone, turning it into a remote surveillance device. The spyware can access all data – photos, videos, text messages and call records – and can also turn on the phone’s camera and microphone to observe the surroundings in real time without the owner’s knowledge.
By clicking on a phony link from the attacker, the targeted user effectively allows their iPhone to be remotely “jailbroken” – a technical term that means removing software restrictions imposed on iOS and Apple devices. Once jailbroken, the iPhone comes under the control of the attacker.
Apple patched this loophole, but Pegasus evolved to become more effective – able to infect targeted devices without owners clicking on a booby-trapped link or message.
Previous attacks
The notorious spyware first made headlines in Thailand during General Prayut Chan-o-cha’s second administration in November 2021. Apple warned at least six critics of the government that their phones were being targeted, raising suspicions that Thai state agencies were using Pegasus.
In 2022, a joint investigation by Thai human rights group iLaw, Southeast Asian internet watchdog Digital Reach, and Canadian cybersecurity watchdog Citizen Lab found that at least 30 government critics had been targeted by Pegasus spyware between October 2020 and November 2021.
