WhatsApp Slams NSO Group for Violating Court Order

WhatsApp has caught and disrupted a new hacking campaign linked to NSO Group, accusing the spyware maker of violating a court order.

WhatsApp Disrupts NSO-Linked Hacking Campaign

On Monday, the Meta-owned chat app announced that it “caught and disrupted spear phishing attempts linked to NSO” after an investigation prompted by user reports. “They tried to trick people into clicking on malicious links to drive them to external websites outside of WhatsApp,” the company wrote. “We also caught them creating test accounts and groups on WhatsApp, which we took down.”

The attacks were similar to another phishing campaign that relied on users clicking on malicious links, which would then lead to the targets being infected with NSO’s spyware Pegasus, a campaign that was reported in Jordan in 2024.

NSO’s History of Abuse

Last year, as part of a years-long lawsuit launched by WhatsApp against NSO, a court ordered the spyware maker to stop targeting WhatsApp and its users. WhatsApp claimed that the new phishing campaign revealed on Monday violated this permanent injunction, and as such filed a contempt order against NSO.

The injunction stems from a 2019 mass-hacking campaign by NSO that targeted more than 1,400 WhatsApp users. Following the discovery, WhatsApp notified the victims and sued the spyware maker. A jury ordered NSO to pay $167 million in damages, which were later lowered to $4 million.

Pressure Mounts on NSO

Over the last decade, security researchers, journalists, and tech companies like WhatsApp, have documented dozens of cases where government hackers used NSO’s spyware to target and hack the phones of journalists, dissidents, human rights workers, and political opponents. Tech companies have responded in several ways: exposing these hacking campaigns publicly, notifying victims, filing lawsuits against the spyware makers, and launching new special opt-in security features designed to make devices and apps harder to hack, specifically by government customers armed with powerful spyware, like NSO's Pegasus.

At the same time, the U.S. government has also put pressure on NSO by putting it on a blocklist, and imposed sanctions on other spyware makers like Intellexa and its founder.

NSO’s Future Uncertain

Last year, a group of U.S. investors purchased NSO with the hopes of cleaning up the company’s reputation, as well as lobbying the U.S. government to lift its measures against the company.

While NSO continues with its plan to enter the American market, the U.S. government has yet to remove NSO from the U.S. Commerce Department blocklist.