The security firm Kaspersky Labs mentions that the spyware can:
•Read messages
•Scan emails
•Listen to the infected device’s calls
•Take photos
•Record keystrokes
•Read browser history
•Access contacts
As mentioned, the spyware can hijack a given device’s camera and microphone at any time. Hence, it can transform a device from a simple smartphone to a surveillance device that works in real-time.
Judging by the complexity of the tasks Pegasus can take on, it is safe to assume that if you don’t have a high-level and public position, you are likely safe from Pegasus.