UAE put NSO spyware on Khashoggi wife's phone: report

A UAE agency placed spyware on Saudi journalist Jamal Khashoggi's wife's phone, months before he was killed, according to reports.

The phone of Khashoggi's then-fiance, Hanan Elatr, was infected with Pegasus spyware developed by the Israeli NSO group in April 2018 while she was in UAE custody, according to The Washington Post on Tuesday.

Elatr - who The Washington Post says was Khashoggi's fourth wife after three previous divorces, as the pair wedded in a secret Islamic ceremony in June 2018 which many of his friends were unaware of - was reportedly detained by the Emiratis in April 2018 after arriving in Dubai.

There she handed over her electronic devices - including two Android mobile phones -  and her passwords before being interrogated about Khashoggi, according to the report.

"While [Elatr's] devices were still in official custody, someone opened the Chrome browser on one of the Androids... [and] tapped in the address of a website on the phone's keyboard... the website sent the phone a powerful spyware package, known as Pegasus," the report states.

The Washington Post conducted the analysis alongside cybersecurity expert Bill Marczak - who investigated Elatr's Androids - from the University of Toronto’s Citizen Lab, a cybersecurity watchdog organisation that has investigated the misuse of Pegasus spyware.

The website entered into the phones was configured by NSO for a UAE customer, according to Marczak.

He noted that the Android tried to install Pegasus but could not confirm if the installation was successful. The fact that the website was not typed in a second time would indicate it was.

The investigation also challenges NSO's claims that Hanan Elatr wasn't targeted by them. The Washington Post revealed a lawyer for the tech firm told the newspaper earlier this year that "Pegasus was not used to listen to, monitor, track, or collect information about Ms. Elatr".

NSO Group has come under fire in recent years after their Pegasus spyware was found on the phones of human rights activists, journalists, dissidents and other public figures across the world.

Khashoggi was reportedly killed by a Saudi hit squad at the kingdom's consulate in Istanbul on 2 October 2018, after entering the building to collect papers for a planned wedding to his then-fiance Hatice Cengiz. Islamic law permits men to have more than one spouse.

The late journalist's fiance Hatice, who has declined to comment on Khashoggi's alleged marriage, was the last person to see him alive before he entered the Saudi consulate in October that year. She alerted the authorities when he did not emerge and led an international campaign to uncover the truth behind his murder.

Both women have been targeted using the NSO tool.