ANKARA, Turkey — NSO Group's Pegasus spyware was used to secretly target the smartphones of the two women closest to murdered Saudi columnist Jamal Khashoggi, according to digital forensic analysis.

The Android phone of his wife, Hanan Elatr, was targeted by a Pegasus user six months before his killing, but the analysis could not determine whether the hack was successful. The iPhone of his fiancee, Hatice Cengiz, was penetrated by spyware days after the murder, the forensics showed.

Their cellphone numbers appeared on a list of more than 50,000 numbers that are concentrated in countries known to spy on their citizens and also known to have been NSO clients.

Another of Khashoggi's close associates was successfully hacked after the journalist's murder. Two other associates and two senior Turkish officials involved in his homicide investigation appear on the list.

NSO executives have asserted that its spyware was not used to monitor Khashoggi or his family.

But a Pegasus user sent texts to Elatr, an Egyptian flight attendant Khashoggi fell in love with and eventually married, with links that could have implanted spyware; the user twice masqueraded as her sister. The texts were sent November 2017 and again in April 2018, six months before Khashoggi's murder on Oct. 2, 2018, according to a digital forensic examination conducted by Amnesty International's Security Lab.

She has no memory of clicking on the links. Because she was using an Android phone, Amnesty's researcher was unable to determine whether the device was successfully penetrated. Unlike iPhones, Androids do not log the kinds of information required for Amnesty's detective work.

During the months when the targeting occurred, Elatr and Khashoggi were talking and texting multiple times a week, she said in recent interviews. They also met in person three times in various locations. Khashoggi taught her to use various apps because he thought switching among them would help thwart surveillance, she said.

"Jamal warned me before that this might happen," said Elatr, who married Khashoggi in an Islamic wedding in June 2018 in Alexandria, Va., near where he lived in self-imposed exile. "It makes me believe they are aware of everything that happened to Jamal through me." Elatr said she kept her phone on the tea table in their living room in Virginia while he talked to colleagues overseas. Pegasus can steal a phone's content and turn on its microphone for real-time monitoring, according to cybersecurity experts.

After Khashoggi's murder, someone using Pegasus targeted Cengiz's iPhone. She had accompanied him to the gates of the Saudi Consulate in Istanbul as he went to pick up documents in October 2018.

Her cellphone was breached just four days after Khashoggi's murder and then five times in the days following that, according to the Amnesty analysis. The analysis could not determine what was taken from the phone or whether any audio surveillance took place.

At the time, the two women did not know about each other.

When Cengiz was told of the breach in an interview in Istanbul, she replied: "I was expecting that, but I am upset. I want to be a normal person, as anyone. All these things make me sad and scared. My phone could be attacked again in the future, and I feel I don't have any way to protect myself from this."

Whether Khashoggi's cellphone was also hacked is not known. He left his phone with Cengiz when he entered the consulate. She gave it to Turkish authorities. Authorities have kept it and have declined to say whether it had been hacked, citing the ongoing homicide investigation.

Agnès Callamard, the former United Nations rapporteur who investigated the murder and is now secretary general of Amnesty International, said the use of Pegasus against Khashoggi's inner circle and investigators "indicates an attempt to be on top of what may be revealed [by the Turkish investigation]."

This article is part of a global investigation, organized by the Paris-based journalism nonprofit Forbidden Stories, into the use of NSO's Pegasus spyware against journalists, civic activists, business executives and political opponents. The Israeli firm says it licenses its spyware only to vetted governments and does not operate the software that its clients use under license. NSO says its spyware is supposed to be deployed against terrorists and criminals. It says it operates ethically and monitors its clients for human rights abuses.

The investigation by 17 media organizations, including The Post, relied on interviews and digital analysis of 67 iPhones that appeared on a list of more than 50,000 numbers that are concentrated in countries known to spy on their citizens and also known to have been NSO clients. The list does not name the clients nor does it indicate whether the phones were targeted or surveilled. Amnesty and Forbidden Stories had access to those records, which were subjected to further analysis by the media partners.

The company denied that its technology was used against Khashoggi or his associates.

"As NSO has previously stated, our technology was not associated in any way with the heinous murder of Jamal Khashoggi," NSO said in a statement. "This includes listening, monitoring, tracking, or collecting information. We previously investigated this claim, immediately after the heinous murder, which again, is being made without validation."

The second Khashoggi associate whose phone was penetrated with Pegasus, according to the forensics, was Wadah Khanfar, a former Al Jazeera journalist.

"I felt my phone or Hatice's phone might have been hacked because some of the conversations we had about Jamal's disappearance came out [in public] during the first days," Khanfar said.

The Khashoggi associates whose phone numbers appear on the list, but whose smartphones were not forensically examined, are Turkish journalist Turan Kislakci and an exiled human rights defender in London who spoke on the condition of anonymity because he feared for his safety.

Two Turkish officials deeply involved in the Khashoggi homicide investigation also appear on the list that contained the numbers of the two women closest to Khashoggi: Irfan Fidan, then the prosecutor, and Yasin Aktay, an influential member of the ruling conservative Islamist party and adviser to the president. They declined to submit their phones to forensic analysis.

Only one of the Turkish officials, Aktay, agreed to be interviewed.

Aktay said that shortly after Khashoggi's murder, Turkish intelligence officials informed him that they had discovered that his new iPhone had been hacked and that he had been under surveillance.

"I was warned by someone from the Turkish security authorities that they had detected someone trying to hack into my phones back then," he said. "They didn't say who tried to hack my phone. However, they said that there are many such attempts. They also said that the simplest precaution I should take in this regard would be to change my phone device. So I changed my phone device. But I always saw the possibility of such a leak."

Aktay said he was not told who did the hacking. The intelligence officials declined to comment for this article.

Aktay said authorities then gave him special security protections, including a bodyguard and a car equipped with police lights and a handheld, remote-controlled siren. They also gave Cengiz a bodyguard and car for her protection after she began receiving death threats on social media, she said.

Aktay still has a bodyguard, who recently drove him and two journalists at 120 mph to the Ankara airport. As the car barreled down the highway, he was asked about the excessive speed and danger. "It's the best way," Aktay said. "It's very hard to assassination, to have an assassination plan, when you go fast."

Khashoggi gave Aktay's name to Cengiz and others as his emergency contact. Aktay believes that when he became a vocal critic of the Saudi government after the murder, the monarchy became interested in what they believed he was planning against them.

The U.S. intelligence community concluded that the murder could not have taken place without the prior knowledge of Saudi Arabia's young iron-fisted leader, Crown Prince Mohammed bin Salman.

Aktay said he believes he was targeted because he continues to write about Khashoggi and to send his writings to thousands of readers. "They are trying to kill even the ghost of Jamal Khashoggi," he said, referring to the Saudi government.

Callamard said the Saudi government "saw Turkey as the heart of what they needed to control."

In the current cold war power struggle in the Middle East, Turkey, Qatar and Iran are aligned against Saudi Arabia, Egypt, the UAE and Bahrain. Turkish President Recep Tayyip Erdogan, himself a frequent jailer of journalists and bloggers critical of his rule, nonetheless befriended Khashoggi.

The disruption in the lives of the two women in Khashoggi's life shows the impact that even the fear of spying can have. Both of them had fulfilling, independent lives before they began a romantic relationship with him; both now live in hiding and have been forsaken by friends who fear for their own safety because they know authorities can link them via their phones and through social media, texts and other communications.

Elatr's life was endangered after she began dating the columnist in March 2018. In April, authorities in the UAE stopped her at the airport, where they confiscated her phone, detained her and interrogated her several times. Later, they twice placed her under house arrest for weeks. She said they wrongly portrayed his efforts to create an independent media organization as the formation of a secret network to overthrow autocrats in the Middle East.

Elatr lives in hiding in the Washington area and has applied for political asylum. She said she fears most for family members, some of whom have been interrogated by UAE and Egyptian authorities. "I just want them to leave me in peace, please leave me in peace," she said.

Cengiz was a scholar who conducted field work in the Middle East before she met Khashoggi. "Before I met him, I was living a really rich life," she said. "I had many things to do every day. I became a working person." Now she says she can't return to her scholarship as a Persian Gulf expert. "Now I cannot travel to any Arab country. Can you imagine that?"

"I'm paying a price, but for what?" she asked.

Priest and Bouvart reported from Ankara and Istanbul. Mekhennet reported from Washington and Berlin. Bouvart is an investigative reporter and videographer at Forbidden Stories.

Forbidden Stories, a Paris-based journalism nonprofit, and Amnesty International had access to a list of phone numbers concentrated in countries known to surveil their citizens and also known as clients of NSO Group. The two nonprofits shared the information with The Post and 15 other news organizations worldwide that have worked collaboratively to conduct further analysis and reporting over several months. Forbidden Stories oversaw the Pegasus Project, and Amnesty International provided forensic analysis but had no editorial input.

More than 80 journalists from Forbidden Stories, The Washington Post, Le Monde, Süddeutsche Zeitung, Die Zeit, the Guardian, Daraj, Direkt36, Le Soir, Knack, Radio France, the Wire, Proceso, Aristegui Noticias, the Organized Crime and Corruption Reporting Project, Haaretz and PBS Frontline joined the effort.

related stories

• Business as usual: Cash, weapons flow between US and Saudi Arabia following Khashoggi’s death