{ "id": "8d9a2391-a9d2-4978-9a80-6d59b52ed658", "created_at": "2026-04-06T00:06:08.681015Z", "updated_at": "2026-04-10T03:24:16.940914Z", "deleted_at": null, "sha1_hash": "2a11da5939ddf179f2134584ab4782d7387afaf9", "title": "Viktor Orbán accused of using Pegasus to spy on journalists and critics", "llm_title": "", "authors": "", "file_creation_date": "0001-01-01T00:00:00Z", "file_modification_date": "0001-01-01T00:00:00Z", "file_size": 2865724, "plain_text": "Viktor Orbán accused of using Pegasus to spy on journalists and\r\ncritics\r\nBy Shaun Walker\r\nPublished: 2021-07-18 · Archived: 2026-04-05 16:41:51 UTC\r\nViktor Orbán’s government has deployed a new weapon in its war on the media in Hungary, according to forensic\r\nanalysis of several mobile devices, using some of the world’s most invasive spyware against investigative\r\njournalists and the circle of one of the country’s last remaining independent media owners.\r\nThe Pegasus project, a collaborative investigation run by the French nonprofit journalism organisation Forbidden\r\nStories, has reviewed leaked records that suggest a wide range of people in Hungary were selected as potential\r\ntargets before a possible hacking attempt with the sophisticated Pegasus spyware, sold by the Israeli company\r\nNSO Group. In a number of cases, forensic analysis confirmed devices had been infected with Pegasus.\r\nThe leaked data includes the phone numbers of people who appear to be targets of legitimate national security or\r\ncriminal investigations.\r\nQuick Guide\r\nWhat is in the Pegasus project data?\r\nShow\r\nHowever, the records also include the numbers of at least 10 lawyers, an opposition politician and at least five\r\njournalists.\r\nThe phones of two journalists at the Hungarian Pegasus project partner, the investigative outlet Direkt36, were\r\nsuccessfully infected with the spyware, including Szabolcs Panyi, a well-known reporter with a wide range of\r\nsources in diplomatic and national security circles.\r\nForensic analysis of his device by Amnesty International stated conclusively it had been repeatedly compromised\r\nby Pegasus during a seven-month period in 2019, with the infection often coming soon after comment requests\r\nmade by Panyi to Hungarian government officials.\r\nhttps://www.theguardian.com/news/2021/jul/18/viktor-orban-using-nso-spyware-in-assault-on-media-data-suggests\r\nPage 1 of 8\n\nSzabolcs Panyi, left, and colleague András Szabó. Photograph: Andras Petho/Direkt36\r\nPegasus enables the attacker to view all content on a phone, including messages from apps with end-to-end\r\nencryption, photographs and GPS location data. It can also turn the device into an audio or video recorder. NSO\r\nhas claimed the spyware is only meant for use against serious criminals and terrorists.\r\nPanyi thinks some in the Orbán government believe independent journalists are part of a conspiracy against them.\r\n“I think there’s widespread paranoia and they see much more in our motives and our networks than there actually\r\nis,” he said.\r\n“We are not aware of any alleged data collection claimed by the request,” said a Hungarian government\r\nspokesperson in response to detailed questions about the targeting of Panyi and others.\r\nNSO Group said it “does not have access to the data of its customers’ targets”, cast doubt on the significance of\r\nthe leaked data and said it would “continue to investigate all credible claims of misuse and take appropriate\r\naction”.\r\nPreviously, Orbán’s spokesperson Zoltán Kovács has publicly attacked Panyi, accusing him of “Orbánophobia and\r\nHungarophobia” and describing him as “deep into political activism”.\r\nSince Orbán became prime minister in 2010, Hungary has fallen from 23rd to 92nd in the World Press Freedom\r\nIndex. Earlier this month, Reporters Without Borders put Orbán on its Enemies of Press Freedom list, the first\r\ntime an EU leader has featured.\r\nhttps://www.theguardian.com/news/2021/jul/18/viktor-orban-using-nso-spyware-in-assault-on-media-data-suggests\r\nPage 2 of 8\n\nSunrise in Budapest. There are few remaining Hungarian media outlets that are not under some\r\nkind of government control. Photograph: Attila Kisbenedek/AFP via Getty Images\r\nThere have been almost no cases of physical violence against journalists in Hungary; instead, Orbán’s war of\r\nattrition against the media has used different means. These have included harassment of independent journalists,\r\npressure on media owners, withdrawing state advertising funds from critical titles and aggressive takeovers by\r\ngovernment-friendly figures.\r\nWhen his forensics report came through, Panyi sat down in Direkt36’s Budapest newsroom, a modest suite of\r\noffices inside a grand building one block from the Danube, and sketched out a chart in blue pen.\r\nOn the left-hand side: dates on which he sent official requests for comment to the Hungarian government. On the\r\nright: dates on which forensic analysis shows his phone was compromised by Pegasus.\r\nThe correlation was hard to ignore. On 3 April 2019, for example, Panyi sent a request for comment to several\r\ngovernment departments in relation to a story he was working on about a Russian bank that was relocating to\r\nBudapest despite concerns it could be a front for Russian intelligence. One day later, Panyi’s phone was infected\r\nwith Pegasus.\r\nThere were 11 occasions when a Pegasus infection was confirmed within a few days of a comment request from\r\nPanyi to the government, according to Amnesty’s analysis.\r\nMore than half the comment requests he sent to various government offices during a seven-month period were\r\nfollowed up with an attack. The tactic, he assumes, was for the government to get ahead of the story, work out\r\nwhat he was planning to publish and attempt to identify his sources.\r\nAnalysis carried out on the phone of one of Panyi’s colleagues at Direkt36, András Szabó, also returned positive\r\nresults. Direkt36 is one of just a few remaining Hungarian outlets not under some kind of governmental control or\r\ninfluence.\r\nOther Hungarians selected for potential targeting include a photographer who worked as a fixer for a visiting\r\nforeign journalist, and a well-known investigative journalist, who declined to have forensic analysis done or to be\r\nnamed, citing a fear of losing sources.\r\nhttps://www.theguardian.com/news/2021/jul/18/viktor-orban-using-nso-spyware-in-assault-on-media-data-suggests\r\nPage 3 of 8\n\nAnother Hungarian journalist selected as a candidate for possible surveillance was Dávid Dercsényi, who edits a\r\nnewspaper put out by the authority of Budapest’s opposition-run eighth district and previously worked for five\r\nyears for the website of the independent outlet HVG.\r\nThree numbers linked to Dercsényi, including one belonging to his ex-wife that had been registered in his name,\r\nwere found in the data.\r\nHe expressed puzzlement his name was in the data. “Mostly I was working on average, not-very-sensitive topics,”\r\nhe said. He suspects a request for comment sent to the government over a story about the trial of a former Islamic\r\nState operative could have drawn attention. He was no longer in possession of any of the three phones appearing\r\nin the data, so analysis was not possible.\r\nMore than 70 editorial staff at index.hu walked out of the newsroom after submitting\r\nresignations following Szabolcs Dull’s dismissal as editor in July 2020. Photograph: Bődey\r\nJános/Index\r\nThe decline of the major online news site Index last year, under pressure from a government-linked businessman,\r\nleft 24.hu, owned by the wealthy investor Zoltán Varga, as the biggest independent news site in the country.\r\nVarga has long been in Orbán’s crosshairs. In an interview on the terrace of his grand villa in the Buda Hills, he\r\ndescribed receiving both enticements and threats from government-linked businesspeople to sell 24.hu and the rest\r\nof his sizeable media portfolio, which includes the country’s bestselling women’s magazine. On one occasion, he\r\nclaims, he was told he would receive generous state advertising subsidies if he made editorial staffing changes.\r\nPegasus: the spyware technology that threatens democracy – video\r\n“They think everything is about money. But I already have money … Slowly I turned into an enemy,” he said.\r\nHe began to notice men in parked cars outside his home and unwanted eavesdroppers on his business meetings in\r\nrestaurants. He said sometimes in the middle of a phone call, he would hear a recording of the call played back,\r\nfrom the beginning. On one occasion, a black helicopter hovered above his house and made three incursions into\r\nhis garden – an intimidation tactic, he believes. Varga has round-the-clock security at his home and has long been\r\nwary of speaking on the phone.\r\nhttps://www.theguardian.com/news/2021/jul/18/viktor-orban-using-nso-spyware-in-assault-on-media-data-suggests\r\nPage 4 of 8\n\nThe Hungarian investor Zoltán Varga. Photograph: Central Media Group\r\nHe was right to be worried. A few weeks after Orbán won a third consecutive term as prime minister in spring\r\n2018, Varga invited six friends to dinner. Among them was Attila Chikán, a minister in Orbán’s first government\r\nin the late 1990s, who has since become a staunch critic of the prime minister. The others were wealthy and well-connected businessmen.\r\nOver wine and finger food on Varga’s expansive terrace, the men discussed creating a new foundation that among\r\nother things would investigate and expose corruption among Hungary’s ruling elite. “It was a friendly\r\nconversation, it wasn’t a coup,” said Varga.\r\nTwo weeks later he met a government-linked acquaintance for coffee and she demonstratively referenced the\r\ndinner, suggesting such meetings could be “dangerous” for him. Varga suspected Orbán’s circle had somehow put\r\nthe meeting under surveillance.\r\nIndeed, the records show all seven people at the dinner were selected as potential candidates for surveillance.\r\nForensic analysis carried out on the handset of one of those present showed clear evidence of a confirmed\r\ninfection at the time of the dinner. The phone of another participant showed signs of Pegasus activity but not of\r\ncompromise.\r\nhttps://www.theguardian.com/news/2021/jul/18/viktor-orban-using-nso-spyware-in-assault-on-media-data-suggests\r\nPage 5 of 8\n\nQ\u0026A\r\nWhat is the Pegasus project?\r\nShow\r\nOne of those present expressed surprise the meeting had attracted such attention. “It was a typical Hungarian\r\ndiscussion. We sat down, everybody said: ‘Fuck, the situation is really bad,’ but then it did not lead anywhere,” he\r\nsaid.\r\nAlong with Varga’s circle, the son and lawyer of the oligarch Lajos Simicska, Orbán’s childhood friend turned\r\nenemy, also appear to have been candidates for surveillance around the time that Simicska was pressured into\r\nselling his critical media holdings to government-friendly figures in 2018.\r\nAjtony Csaba Nagy, Simicska’s lawyer, recalled noticing strange sounds or replayed conversations during phone\r\ncalls in 2018. “It also happened that some information appeared in the press that we only discussed on the phone,\r\nnowhere else,” he told Direkt36.\r\nHungary, Israel and Pegasus\r\nA former NSO employee confirmed Hungary was among the company’s clients. It apparently acquired Pegasus in\r\nthe aftermath of a 2017 visit to the country by the then Israeli prime minister, Benjamin Netanyahu, a close Orbán\r\nally. NSO has denied it takes any direction from the Israeli government when choosing its customers.\r\nBenjamin Netanyahu and Viktor Orbán shake hands at a joint press conference in Budapest in\r\n2017. Photograph: AFP Contributor/AFP/Getty Images\r\nIn response to detailed allegations about Hungary’s acquisition and use of Pegasus, a Hungarian government\r\nspokesperson said: “Hungary is a democratic state governed by the rule of law, and as such, when it comes to any\r\nindividual it has always acted and continues to act in accordance with the law in force. In Hungary, state bodies\r\nauthorised to use covert instruments are regularly monitored by governmental and non-governmental institutions.”\r\nhttps://www.theguardian.com/news/2021/jul/18/viktor-orban-using-nso-spyware-in-assault-on-media-data-suggests\r\nPage 6 of 8\n\nHungary has one of the loosest legislative frameworks in Europe for the authorisation of surveillance. There is no\r\njudicial oversight if the request is made for national security reasons; only the signature of the minister of justice\r\nis required.\r\nInformation released to the Hungarian outlet 168 Óra under a freedom of information request showed the justice\r\nminister, Judit Varga, approved 1,285 surveillance requests in 2020, which includes all forms of surveillance, not\r\njust Pegasus.\r\nIn an earlier interview with a Pegasus project partner, Varga said it was a “provocation” to ask whether she would\r\nauthorise surveillance of a journalist, but said “there are so many dangers to the state everywhere” when asked\r\nwhy she had approved so many requests. The justice ministry did not respond to detailed allegations about\r\nHungary’s use of Pegasus.\r\nThe government communications office, when presented with the same allegations, replied with questions of its\r\nown: “Have you asked the same questions of the governments of the United States of America, the United\r\nKingdom, Germany or France? In the case you have, how long did it take for them to reply and how did they\r\nrespond? Was there any intelligence service to help you formulate the questions?”\r\nOrbán has built his political platform on staunchly opposing migration and claiming Hungary is under attack from\r\na network directed by the Hungarian-American financier and philanthropist George Soros.\r\nThe leaked data reveals at least one case in which Pegasus appears to have been used in the hope of uncovering –\r\nor inventing – a “Soros conspiracy”.\r\nOne of the numbers in the data belonged to Adrien Beauduin, a Belgian-Canadian PhD student.\r\nAdrien Beauduin. Photograph: Szabolcs Nagy/Index\r\nOn paper, he was the perfect “villain” for the Orbán government: a gender studies student at Central European\r\nUniversity (CEU), an institution founded by Soros. At the time, the government was in the process both of ending\r\nthe teaching of gender studies in Hungary and of forcing CEU out of the country.\r\nhttps://www.theguardian.com/news/2021/jul/18/viktor-orban-using-nso-spyware-in-assault-on-media-data-suggests\r\nPage 7 of 8\n\nBeauduin was arrested at a protest in Budapest in December 2018 and charged with assaulting police officers,\r\nwhich carries a sentence of up to eight years in prison. He denies he was in any way violent towards police.\r\nBeauduin’s lawyer, Kata Nehéz-Posony, said there was “no real evidence” against him except for police testimony\r\nthat was copied word for word from the case of another person arrested.\r\nShe said she suspected the arrest was “highly politically motivated”. On 14 December, a few days after the arrest,\r\nthe then communications chief of Orbán’s Fidesz party publicly noted that “the pro-immigration Soros network is\r\norganising violent demonstrations in Budapest”.\r\nAnalysis of Beauduin’s phone showed Pegasus activity on the device shortly after this, though no sign of\r\nsuccessful infection. Eventually, the most serious charges against him were dropped, suggesting nothing\r\nincriminating was found.\r\nA former senior Hungarian counter-intelligence officer who left the service in the early part of the last decade\r\nadmitted there was a flexible approach to concocting national security reasons for surveillance during his time.\r\n“[But] there were two professions we kept our distance from: lawyers and journalists,” he said.\r\nThe leaked records, and the analysis of infected devices, suggest that in Orbán’s Hungary today, this is no longer\r\nthe case.\r\nSource: https://www.theguardian.com/news/2021/jul/18/viktor-orban-using-nso-spyware-in-assault-on-media-data-suggests\r\nhttps://www.theguardian.com/news/2021/jul/18/viktor-orban-using-nso-spyware-in-assault-on-media-data-suggests\r\nPage 8 of 8", "extraction_quality": 1, "language": "EN", "sources": [ "Malpedia" ], "references": [ "https://www.theguardian.com/news/2021/jul/18/viktor-orban-using-nso-spyware-in-assault-on-media-data-suggests" ], "report_names": [ "viktor-orban-using-nso-spyware-in-assault-on-media-data-suggests" ], "threat_actors": [ { "id": "dfee8b2e-d6b9-4143-a0d9-ca39396dd3bf", "created_at": "2022-10-25T16:07:24.467088Z", "updated_at": "2026-04-10T02:00:05.000485Z", "deleted_at": null, "main_name": "Circles", "aliases": [], "source_name": "ETDA:Circles", "tools": [], "source_id": "ETDA", "reports": null } ], "ts_created_at": 1775433968, "ts_updated_at": 1775791456, "ts_creation_date": 0, "ts_modification_date": 0, "files": { "pdf": "https://archive.orkl.eu/2a11da5939ddf179f2134584ab4782d7387afaf9.pdf", "text": "https://archive.orkl.eu/2a11da5939ddf179f2134584ab4782d7387afaf9.txt", "img": "https://archive.orkl.eu/2a11da5939ddf179f2134584ab4782d7387afaf9.jpg" } }