The spyware that asks nothing of you

For years, personal security came down to one commandment: don't click the bad link. Then researchers pulled apart a piece of software called Pegasus, and the commandment stopped being enough.

Pegasus, built by the Israeli firm NSO Group and sold to governments, could take over an iPhone without its owner doing anything at all. No suspicious link, no dodgy attachment, no tap. A single message could arrive and silently install it — a "zero-click" attack — and from that moment the phone belonged to someone else. Not just the data on it: the microphone, the camera, the location, the messages typed before they were even sent. Investigators at Amnesty International and the University of Toronto's Citizen Lab documented it on the phones of journalists, lawyers, and activists around the world.

The lesson for the rest of us isn't that we're all targets of nation-state spyware. It's what the story reveals about the device itself. The phone in your pocket and the laptop on your desk are where your financial life actually happens — where the passwords autofill, the codes arrive, the accounts stay logged in. That makes the device the prize. And "be careful what you click" is a defense built for a threat that no longer needs your cooperation.

Which is why the machines that touch your money deserve more than the protection they came with out of the box. Corporate-grade endpoint protection — the kind that actively watches a device, flags strange behavior, and updates the instant a new exploit appears — is standard issue at any serious company. On the two or three devices that run your life, it's the difference between a lock and a guard.

Pegasus was exotic and expensive. The ordinary versions — a lookalike app, a poisoned document, malware bundled into "free" software — are neither. They're all aimed at the same place: the thing in your hand that already knows all your secrets.