Rabbi Jeff verified checkmark

The post, from an X account called @RabbiJeffx and appearing to date from about 8 November 2026, says Spanish authorities have 'just' revealed that NSO's spyware infected the Prime Minister's phone. It also says NSO's Luxembourg subsidiary handled $210 million in sales with no employees, and it asks Grok which country the spyware comes from. The infection itself is well documented, but it was announced by the Spanish government on 2 May 2022, not 'just in'. Pedro Sánchez's phone and Defence Minister Margarita Robles's phone were found to be infected with Pegasus, and about 2.6 GB of data was taken from Sánchez's phone. Spain's High Court (Audiencia Nacional) has since closed its investigation for a second time, in January 2026, citing Israel's failure to cooperate. I found no new Spanish disclosure around November 2026. Grok's answer, 'Israel', is correct: NSO Group is an Israeli company based in Herzliya. However, investors linked to the US have reportedly taken control of the company through Luxembourg holding companies. The figure of $210 million in sales with zero employees could not be confirmed. Luxembourg reporting shows that NSO's Luxembourg entity, Q Cyber Technologies SARL, recorded large sales: about $229 million in 2019 and just under $170 million in 2021. I found no source giving $210 million or a headcount of zero. The 'Country ONLY' prompt invites readers to assume Israel carried out the spying. Spanish courts have not identified who did it, and Spanish reporting names Moroccan intelligence as the main suspect, though this is not proven.

What checked out (5)

• Spanish authorities revealed that the Prime Minister's (Pedro Sánchez's) phone was infected with NSO's Pegasus spyware. The government announced this at a press conference on 2 May 2022 (Al Jazeera, Euronews, France 24, The Record).
• Other senior government devices were also compromised. Defence Minister Margarita Robles's phone was infected (2022). Court records cited in 2026 also include Interior Minister Grande-Marlaska and Agriculture Minister Planas (ARA, Spanish Wikipedia summary of the court file).
• Data was taken from the Prime Minister's phone: about 2.6 GB according to AFP/France 24, and 2.5 GB according to State of Surveillance.
• The spyware is from Israel. Pegasus is made by NSO Group, an Israeli cyber-intelligence company based in Herzliya (Britannica, OCCRP, Wikipedia). Grok's answer 'Israel' is accurate.
• NSO has a significant Luxembourg presence. Q Cyber Technologies SARL is a Luxembourg entity that has recorded large sales: €/$229m turnover in 2019 (Paperjam) and just under $170m in 2021 (Luxembourg Times via Next.ink). A European Parliament inquiry called Luxembourg an 'important business hub' for NSO (Delano, 2023).

• That the Luxembourg subsidiary handled exactly '$210 million' in sales. Published figures for the Luxembourg entity are about $229m (2019) and under $170m (2021). I found no source for $210m in any specific year.
• That the Luxembourg subsidiary had 'ZERO employees'. Luxembourg reporting describes NSO's Luxembourg entities as back-office and holding structures at a single address. An Israeli court ruling describes a different group entity as a shelf company with no employees. But no source I found gives a zero headcount alongside $210m of sales.
• That the news is 'JUST IN', meaning a new revelation by Spanish authorities around November 2026. I found no Spanish government or court disclosure at that time. The latest developments are the court closing the case in January 2026 and media coverage from August to October 2026 of a Moroccan hacker group (Jabaroot) offering files it claims are linked to the case.

Confidence

Medium-High — Confidence is high for the Spanish infection facts, the date of the disclosure, the closure of the case and the spyware's Israeli origin, because several independent, dated, reputable sources agree. Confidence is lower for the Luxembourg figure: published numbers ($229m in 2019, under $170m in 2021) show large sales but do not match $210m, and I could not access register filings directly. So that claim stays Unverified, not False. The judgement that the post is misleading rests on its framing (the timing and the leading prompt), which I could assess directly against dated sources.

Search journal

Spain Pegasus Prime Minister phone NSO 2026

• https://www.upi.com/Top_News/World-News/2026/01/23/Spain-Pegasus-spyware-investigation/2701769172449/
• https://therecord.media/spyware-attack-targeted-spanish-prime-ministers-phone
• https://therecord.media/spanish-judge-closes-nso-group-spyware-probe-israel
• https://stateofsurveillance.org/news/spain-pegasus-probe-closed-israel-2026/
• https://www.aljazeera.com/amp/news/2022/5/2/spain-detects-pegasus-spyware-on-pm-defence-ministers-phones

NSO Luxembourg subsidiary $210 million zero employees

• https://x.com/RabbiJeffx/status/2119344188277903575
• https://delano.lu/article/nso-the-supplier-of-pegasus-spyware-is-changing-hands
• https://www.somo.nl/wp-content/uploads/2021/05/Operating-from-the-Shadows.pdf

Pedro Sánchez phone Pegasus infected government announcement 2022

• https://www.euronews.com/next/2022/05/02/pegasus-spyware-spain-s-prime-minister-and-defence-minister-s-phon...
• https://www.france24.com/en/live-news/20220502-spain-says-pm-targeted-by-pegasus-spyware
• https://www.theweek.in/news/world/2022/05/03/spanish-prime-ministers-phone-was-infected-with-pegasus-spywar...

NSO Group Israeli spyware company Pegasus

• https://www.britannica.com/topic/NSO-Group
• https://www.occrp.org/en/project/the-pegasus-project/where-nso-group-came-from-and-why-its-just-the-tip-of-...
• https://simple.wikipedia.org/wiki/NSO_Group

Spain Pegasus investigation Sánchez 2026 court

• https://en.ara.cat/politics/the-courts-will-not-investigate-the-spying-pedro-sanchez-with-pegasus-due-to-is...
• https://thediplomatinspain.com/en/2026/01/23/the-national-court-dismisses-the-pegasus-case-for-the-second-t...
• https://www.escudodigital.com/en/latest-reports/from-pegasus-to-jabaroot-inside-the-undeclared-cyber-warfar...

NSO Luxembourg Q Cyber Technologies sales no employees

• https://www.somo.nl/wp-content/uploads/2021/05/Operating-from-the-Shadows.pdf
• https://www.technologyreview.com/2020/08/19/1007337/shalev-hulio-nso-group-spyware-interview/

Pegasus Sánchez espionaje noviembre 2026

• https://es.wikipedia.org/wiki/Espionaje_con_Pegasus_al_Gobierno_de_Espa%C3%B1a
• https://www.moncloa.com/2026/09/22/pegasus-espionaje-sanchez-cni-sin-autores-3434863/
• https://www.elindependiente.com/internacional/2026/08/24/a-quien-le-interesan-los-datos-de-pegasus-relacion...

NSO Luxembourg 210 millions sans salarié Q Cyber

• https://next.ink/brief-article/plus-de-la-moitie-des-revenus-de-nso-group-ont-ete-enregistres-au-luxembourg/
• https://paperjam.lu/article/pegasus-cinq-ans-inertie-face-

Q Cyber Technologies Luxembourg Togo Pegasus parliamentary question 2026

• https://paperjam.lu/article/pegasus-au-luxembourg-ce-que-le-controle-ne-controle-pas
• https://delano.lu/article/luxembourg-important-business-

NSO Q Cyber Technologies Luxembourg October 2026 export control millions

• https://x.com/svnee/status/2112570896560861612
• https://en.paperjam.lu/article/nine-nso-entities-in-luxembour

OSY Technologies Luxembourg revenue zero employees

• https://herzoglaw.co.il/en/news-and-insights/israeli-court-takes-aim-at-leveraged-acquisition-structures-fr...

Article metrics

Emotion 2% · Reading grade 11.5 · 133 words