Pegasus software accessed the phones of at least 35 journalists and other citizens in El Salvador in a hack attack on news outlet El Faro and other targets in the country, per a new report.

Why it matters: Wednesday's report by cybersecurity watchdogs Citizen Lab and Access Now comes some two months after the U.S. government added NSO Group, the Israeli firm that produces Pegasus, to its black list of companies engaging in activities contrary to the national security or foreign policy interests of the United States.

Driving the news: The hacking took place July 2020 and November 2021, as the news outlets were "reporting on sensitive issues involving the administration of President Bukele," such as a allegations that the government negotiated a "'pact' with the MS-13 gang for a reduction in violence and electoral support," according to the report. (The government denies this.)

• Other targets included employees of the news outlets "GatoEncerrado, La Prensa Gráfica, Revista Digital Disruptiva, Diario El Mundo, El Diario de Hoy, and two independent journalists," per the report.
• Pro-democracy and human rights groups were among three nongovernmental organizations also targeted, the report said.

For the record: NSO has denied reports its software has been used by governments around the world to spy on journalists, human rights activists and possibly world leaders.

• It has said it's taken all possible steps to ensure its software wouldn't be used for anything other than fighting crime and terrorism.