Poland's Prosecutor's Office reveals findings on the use of Pegasus spyware by the Central Anti-Corruption Bureau, highlighting serious oversight issues.
The Polish Prosecutor's Office has disclosed findings from the Internal Security Agency regarding the use of Pegasus spyware by the Central Anti-Corruption Bureau (CBA).
The investigation revealed that the software enabled unauthorized data extraction from user devices, with the information transmitted outside of Poland.
According to the report, "CBA did not have complete control over the system's operations. The software manufacturer had access to the infrastructure where operational materials were processed and stored."
Experts concluded that Pegasus could be secretly installed on both Android and iOS devices without the owner's knowledge or consent. Once infected, the system could access a wide range of data, including:
- SMS and MMS messages;
- communications from messaging apps and emails;
- browser history;
- call logs, contacts, and calendars;
- photos, videos, documents, and other files;
- geolocation data.
Additionally, the software could read messages stored on devices prior to surveillance, activate microphones and cameras in real time, and take screenshots.
"The data collected was sent from the mobile device in encrypted form to a system server without the user's consent or knowledge," the report stated.
Inadequate Oversight
Experts pointed out that the CBA lacked passwords for some administrative accounts, with certain infrastructure elements still managed by the Israeli firm NSO Group. The server module responsible for infecting devices was solely controlled by this private company.
Another significant finding was regarding the data transmitted via Pegasus. It was routed through an anonymizing network of servers worldwide, managed by the software developer, which also had the technical capacity for remote access during support and updates.
The Internal Security Agency emphasized that their findings do not confirm any illegal use of data by NSO Group.
This expert report is part of a broader investigation that has been ongoing since 2024, resulting in three reports to date.
Initially classified as "top secret," parts of the documents had their classification partially lifted by Poland's Attorney General Waldemar Żurek in the summer of 2026.
The investigation into potential abuse of power and dereliction of duty in the use of Pegasus was initiated by former Attorney General Adam Bodnar, who established a special investigative group.
Charges have been brought against seven individuals, including former CBA head Ernest Bejda, former ABW head Piotr Pogonowski, and former SKW head Maciej Materka.
