Does Switching Off Your Phone Stop Pegasus? ESET Expert Doubts It

Pedro Sánchez's advice to switch off your phone for five minutes a day has drawn a sceptical response from a cybersecurity specialist. Josep Albors, head of research and awareness at ESET Spain, says that "for most users, who face more mundane threats, this advice does little in terms of cybersecurity."

Sánchez made the remark on the show La Revuelta while discussing espionage with Pegasus, the spyware developed by NSO Group. Pegasus can access the information on a phone and can also use its camera or microphone.

Why a restart only helps in some cases

According to Albors, the tip applies only to specific cases in which malware lives in RAM, which is wiped when the device restarts. Some Pegasus versions can run in memory without persistence, which makes them harder to detect, and powering the phone off can interrupt them.

But if malicious software is actually installed on the device, restarting does not remove it, and it can activate again at power-on. Versions resistant to reboots have also been documented. A phone that runs normally afterwards is no proof that the infection is gone.

The bigger issue is the vulnerability itself. Even if a reboot clears the spyware, an unpatched flaw can let an attacker infect the device again, in some cases knowing only the victim's phone number. Some attacks need no click on a link and no downloaded file.

What ordinary users should do

The US National Security Agency recommends restarting a device weekly, which can cut off certain infections. That does not make it a general defence against malware, and it does not fix the security hole used to get in, as a report from the French cybersecurity agency notes.

State-grade tools such as Pegasus target selected individuals and are far from what worries most people. Albors points instead to malicious apps and fraudulent links. Restarting a phone from time to time can still help close background apps or ease memory problems, but it does not mean the device is clean.

The recommended basics are keeping the system updated with security patches, distrusting unsolicited links, installing apps only from official channels, and using a security solution that scans the device and its connections. The reach of those tools depends on the operating system and the permissions they are given.