Jeff Bezos, the billionaire owner of the Washington Post, had no reason to be suspicious when he received a WhatsApp message from the account of the crown prince of Saudi Arabia in May 2018.

Bezos and Mohammed bin Salman had attended a dinner together in Hollywood a few weeks earlier hosted by Brian Grazer, the Oscar-winning producer, and Ari Emanuel, the powerful talent agent, as part of the young crown prince’s tour of America, which was hailed by some observers as an effort to rebrand the kingdom and set it on a new course.

The then 32-year-old Saudi heir, known all over the world as “MBS”, had been greeted with open arms from Los Angeles to New York – with stops at the White House, MIT and Harvard. He had rubbed shoulders with celebrities ranging from Oprah to Dwayne “The Rock” Johnson.

It appeared to be a PR coup for the crown prince, who had previously been criticised by human rights campaigners about his decision to wage a bloody war in Yemen – and also the alleged imprisonment and torture of rich Saudis at the Ritz-Carlton in Riyadh.

Amazon had even been in talks about the possibility of opening data centres in Saudi Arabia.

The dinner engagement could have been the start of a promising relationship between two of the world’s most powerful men. But it would swiftly turn sour – and in spectacular fashion.

According to sources who have spoken to the Guardian, the message sent to Bezos on that Tuesday 1 May from the personal account of the crown prince contained a video file – of what, it is not clear.

But a forensic technical analysis of the file has found that it is “highly probable” it contained malware that penetrated Bezos’s mobile phone and exfiltrated a large amount of data within hours.

Bezos, it seems, had been hacked.

The Guardian has no knowledge about the precise nature of the material that was allegedly taken or what was done with it.

But this apparent targeting of Bezos’s phone appears to fit into a broader pattern of behaviour by Saudi Arabia.

The crown prince and his inner circle have been criticised for attempting to undermine real and perceived critics of his regime all over the world.

Was Bezos, the owner of the Washington Post, the paper that employed the eloquent Saudi dissident Jamal Khashoggi, considered one of them?

Certainly, among all of the perceived enemies of the crown prince, Khashoggi was considered one of the most dangerous. His knowledge of the royal court – he had once worked within it – and the platform then afforded him by such a respected newspaper, gave his articles real weight.

And this was causing great agitation inside the royal court.

Quick guide Alleged Saudi hack of Jeff Bezos: key characters Show Hide Jeff Bezos Founder and CEO of Amazon, Bezos is the world's richest man. He also owns the Washington Post, the newspaper Saudi critic Jamal Khashoggi wrote for. In February last year, Bezos described an alleged extortion campaign by AMI, owner of the National Enquirer, which the previous month had published details of his extra-marital affair, including his private text messages. He said AMI had threatened to publish 'more of my text messages and photos' unless he ceased his investigation into how the National Enquirer obtained his messages. AMI responded it believed 'fervently that it acted lawfully in the reporting of the story of Mr Bezos', but its board would investigate the matter. Jamal Khashoggi The Saudi Arabian dissident and columnist for the Washington Post, who was brutally murdered in the Saudi consulate in Istanbul, Turkey. In the months leading up to his killing, Saudi dissidents and Khashoggi associates are believed to have been targeted by cyber-threats originating from Saudi Arabia. Saudi Arabia initially denied involvement in the killing, claiming Khashoggi left the consulate alive. It later sentenced five Saudis to death over the killing, but cleared senior figures of wrongdoing. Mohammed bin Salman The crown prince of Saudi Arabia and designated heir to his father, King Salman. The purported efforts by MBS, as he is known, to modernise the kingdom since acquiring power in 2017 foundered with the killing of Khashoggi. The CIA reportedly concluded he ordered the assassination. He denies involvement in the killing, but has said he bears responsibility because 'it happened under my watch'. David Pecker The CEO of American Media Inc (AMI). AMI publishes the National Enquirer, which published details of Bezos's extramarital affair after having access to his private text messages. The tabloid insisted it had not been 'instigated, dictated or influenced in any manner by external forces, political or otherwise' and AMI briefed reporters the story came from a tip-off about the affair by the estranged brother of Bezos’s girlfriend. A close friend of president Donald Trump, Pecker and AMI were implicated in the so-called 'catch and kill' scandal that the tabloid bought the exclusive rights to negative stories about Trump during the 2015 presidential election and then buried them. Agnès Callamard The UN special rapporteur who found Khashoggi was the victim of a 'deliberate, premeditated execution, an extrajudicial killing for which the state of Saudi Arabia is responsible under international human rights law'. On Tuesday, she was due to release a statement into the alleged hacking of Bezos's phone. Callamard confirmed to the Guardian she was still pursuing 'several leads' into the murder, but declined to comment on the alleged Bezos link.

According to a New York Times report in 2019, MBS was growing “increasingly alarmed” by Khashoggi’s criticisms during this period.

In September 2017, just as Khashoggi wrote that Saudi Arabia was becoming “unbearable” because of its repression, the young prince privately told an aide that he would use a “bullet” on Khashoggi, according to current and former US and foreign officials cited by the New York Times.

At nearly the same time, the crown prince was developing a relationship with a different American publisher who would print a far more flattering portrait of the Saudi heir.

According to the New York Times, in September 2017, MBS met David Pecker, the chief executive of American Media Inc (AMI), the owner of the National Enquirer supermarket tabloid, in Saudi Arabia.

Pecker is an important player in Washington. Two months earlier he had had a private dinner with Donald Trump in the White House. Among the other guests was Kacy Grine, a financier who reportedly served as an advisor to Saudi royals.

Pecker and Trump were longtime allies. A Department of Justice investigation would later reveal that Pecker had played a critical role in helping the Trump campaign to “kill” negative stories about the then-candidate’s extramarital affairs and pay hush money to women who were interested in telling their stories.

Timeline Alleged Saudi hack of Jeff Bezos Show Hide Mohammed bin Salman, widely known as MBS, becomes crown prince of Saudi Arabia, designated heir to the king. Donald Trump hosts a private White House dinner for a western adviser to MBS and David Pecker, the CEO of American Media Inc (AMI), which publishes the National Enquirer. Mohammed bin Salman meets with David Pecker and the western adviser to the crown prince, in Saudi Arabia. Mohammed bin Salman reportedly tells a top aide he wants to use a 'bullet' on Jamal Khashoggi, who is writing critical columns in the Washington Post. Mohammed bin Salman arrives in the US for a tour to boost Saudi Arabia's reputation with America's most senior VIPs, business leaders and government officials. Trump hosts Mohammed bin Salman at a meeting in the White House, where the US president calls them 'good friends'. AMI publishes nearly-100-page glossy magazine praising Saudi Arabia and Mohammed bin Salman. Mohammed bin Salman is guest of honour at Hollywood dinner. Amazon CEO Jeff Bezos attends. Jeff Bezos and Mohammed bin Salman have WhatsApp exchange. It is now believed, according to sources, a text message sent from the crown prince to Bezos contained a malicious file that infiltrated the phone. Jeff Bezos sends intimate and private text messages to his girlfriend. Jamal Khashoggi killed in Saudi consulate in Turkey. The National Enquirer publishes exposé of Bezos's extramarital affair, including intimate text messages. Jeff Bezos publishes blogpost accusing the National Enquirer of extortion. Saudi Arabia denies any involvement in the publication of the Bezos story. AMI also later dismiss claims of Saudi involvement, insisting it was tipped off about the affair by the estranged brother of Bezos’s girlfriend. Bezos's security chief, Gavin de Becker, publishes Daily Beast article saying investigators concluded with high confidence Saudis had access to Bezos's phone. UN special rapporteur Agnes Callamard finds credible evidence Saudi Arabia is responsible for premeditated murder of Jamal Khashoggi. Guardian reveals Bezos's phone was apparently 'hacked' in May 2018 after receiving a personal WhatsApp message sent from Mohammed bin Salman's personal account. Large amounts of data are exfiltrated from the phone within hours, according to sources. The Guardian has no knowledge about the precise nature of the material that was allegedly taken or what was done with it.

When MBS flew to the US for his maiden trip as crown prince in March of the following year, it was Pecker’s company that published a glossy magazine hailing him as a great leader who would transform the world.

Pecker, Grine, and MBS met for a second time during the crown prince’s stay in New York.

A few weeks after the alleged Bezos hack, another suspected cyber attack was launched. The target was an influential Saudi dissident who was living in Canada and was a close friend of Khashoggi.

According to an analysis by the independent research group Citizen Lab, Omar Abdulaziz received a fake infected link about a delivery he was expecting in late June 2018 that contained malware that infiltrated his phone.

The Guardian understands Khashoggi and Abdulaziz traded “hundreds” of messages in the months that followed.

Abdulaziz has claimed in a lawsuit that his communications were probably intercepted by Saudi Arabia – an allegation the kingdom has denied. But Abdulaziz fears his messages to Khashoggi could have given insights to the people who would later kill him.

He was not alone. Two other dissidents, the London-based satirist Ghanem Almasarir, and Yahya Assiri, a dissident who was in frequent contact with Khashoggi, were also alleged by experts to have been targeted by Saudi cyber threats in that period.

‘Certain powerful people will wrongly conclude I am their enemy’

Two months after the killing on 2 October 2018, another story emerged. It was seemingly unrelated to the murder of Jamal Khashoggi and was far more salacious.

On 10 January 2019, the National Enquirer published a special edition that exposed Bezos had had an affair.

More than a dozen other articles followed across various AMI publications, in what seemed to be a campaign against the CEO.

The story of the extramarital relationship included intimate details – including the text messages he had sent to his girlfriend months earlier, text messages that were sent just days after Bezos’s mobile phone had been sent the WhatsApp message with the malicious file.

Trump, an ardent critic of Bezos, the Washington Post, and Amazon, who was alleged in a media report to be “obsessed” with Amazon, appeared to revel in the news.

“So sorry to hear the news about Jeff Bozo being taken down by a competitor whose reporting, I understand, is far more accurate than the reporting in his lobbyist newspaper, the Amazon Washington Post,” he tweeted. “Hopefully the paper will soon be placed in better & more responsible hands!”

The story did not end there. A few weeks later, on 7 February, Bezos published an extraordinary blogpost titled: “No thank you, Mr. Pecker” in which he described an elaborate “extortion” attempt by the owner of the National Enquirer, which had threatened in emails to publish intimate photographs of Bezos and of his girlfriend if the CEO did not agree to stop an investigation into how the National Enquirer had obtained its information.

AMI insisted that it had not been “instigated, dictated or influenced in any manner by external forces, political or otherwise”.

Bezos rejected the offer and published the email correspondence between them – which included a series of embarrassing descriptions of the photographs AMI alleged it possessed.

“It’s unavoidable that certain powerful people who experience Washington Post news coverage will wrongly conclude I am their enemy,” Bezos wrote. “President Trump is one of those people, obvious by his many tweets. Also, the Post’s essential and unrelenting coverage of the murder of its columnist Jamal Khashoggi is undoubtedly unpopular in certain circles.”

Other experts also weighed in. John Brennan, the former CIA director and CIA station chief in Riyadh, commented on MSNBC: “I have no doubt, given the Post’s relentless and appropriate condemnation of MBS for the killing of Khashoggi, that he would try to discredit, embarrass and hurt Bezos financially if he could.”

A few weeks later, Bezos’s head of security, Gavin de Becker, published his own editorial in the Daily Beast, claiming that his investigation into the National Enquirer leaks had concluded that Saudi Arabia had accessed Bezos’s phone. He declined to publish any further details, but said he had given information about his investigation into the National Enquirer leaks to law enforcement officials. Both Saudi Arabia and Pecker’s AMI flatly denied the allegation and any suggestion that Saudi Arabia was involved in the matter.

Bruce Riedel, a former CIA analyst and Saudi expert, said the potential “hack” of Bezos’s phone reflected the possibility of Saudi’s premeditation.

“We can connect the dots now,” he said. “They actually weaponised this hack into Bezos’s phone to publicly air some very intimate parts of his life story, I assume in an attempt to slander and smear him….[thinking] they might need dirt on him later on.”

It ultimately reflected a lack of understanding of how the US works, Riedel said, and how the Washington Post owner would react to such a threat. He also said the episode raised questions about what US intelligence agents may have known about the hack. It was another example, he said, of how the Trump administration had failed to hold MBS and the Saudis accountable for their alleged abuses.

Last October, Bezos stood in front of the Saudi consulate in Istanbul and paid tribute to Khashoggi at a vigil to commemorate the one-year anniversary of his murder.

“No one should ever have to endure what you did,” he said to Hatice Cengiz, Khashoggi’s fiancee. “You paced that street for hours, pacing and waiting. And he never came out. It’s unimaginable. And you need to know that you are in our hearts. We are here and you’re not alone.”

Both Saudi Arabia and AMI have denied that the kingdom was involved in the publication of the Bezos story.

A lawyer for Bezos who was contacted by the Guardian said: “I have no comment on this except to say that Mr Bezos is cooperating with investigations.”

The Guardian asked the Saudi embassy in Washington about the claims. It did not immediately return a request for comment.

Have you got new information about this story? You can message Guardian investigations using Signal or WhatsApp: +447584640566. For the most secure communications, use SecureDrop. You can also email: stephanie.kirchgaessner@theguardian.com.

