The Spyware Beat Published Nothing Over the Weekend, and Three Old Reports Are Ranking as Today’s

The newest substantive spyware research retrievable this morning is three weeks old. Amnesty International’s Security Lab published “Inside Pegasus: The evolution of the world’s most notorious spyware” in July, around 20 July by the tool’s stamp. Middle East Eye’s report on a Moroccan whistleblower describing Rabat’s use of Pegasus against dissidents dates from the same week — the item with the most political weight in the region, and no official Rabat response to it has been found in the three weeks since. Citizen Lab’s “Bad Connection”, on global telecom exploitation by covert surveillance actors, carries page dates of 23 April and 8 May; it is currently recirculating through a Facebook post that reframes it as an Israeli-linked telecom surveillance finding. The secondary framing is what is new. The research is not.

The one item genuinely stamped inside the window is a vendor product: SOCRadar’s Iran–Israel/US cyber-war dashboard registered an update around 8 August. A living dashboard refresh is not an event, and the firm publishing it has a commercial interest in the conflict’s salience; it is worth using to find which discrete incidents were added, not as evidence that any occurred. The same recirculation problem attaches to influence-operations material — OpenAI’s disclosure of PRC-linked operations targeting US AI debates is dated 10 June, and Meta’s threat-reporting hub was last stamped 14 May. Searching the window turned up no new APT report from a major vendor, no takedown announcement, no destructive-malware incident and no internet shutdown.

Assessment: Two cautions. First, 7 to 9 August was a Friday-to-Sunday, when vendor research and government advisories are rarely published; a blank window at this search depth is suggestive, not proof of a quiet weekend, and shutdown trackers in particular are the wrong thing to interrogate through a search engine. Second, the mechanism worth naming is the ranking system, not any actor’s malice: undated pages and cached stamps push April research to the top of an August query, and social reposting supplies the false immediacy. The Morocco silence is the reportable item here — a named whistleblower account, three weeks on the record, unanswered.