The devices of at least sixty-five pro-independence Catalans were targeted with Pegasus and Candiru spyware. Most of the incidents occurred between 2017 and 2020, amid rising tensions over Catalan separatism and the 2017 Catalan independence referendum. Analysts found evidence on the victims’ devices of “zero-click” exploits, which infect phones and computers even without users clicking on malicious links. Reports indicate Spain’s intelligence service had prior court approval to use the spyware to target Catalan separatists.