WhatsApp has accused spyware firm NSO Group of violating a permanent U.S. court injunction by allegedly attempting fresh spyware-linked attacks against its users, bringing the long-running battle between encrypted messaging platforms and surveillance-for-hire vendors back into focus.
TL;DR
- WhatsApp says it disrupted spear-phishing attempts linked to NSO Group.
- Meta is asking a federal court to hold NSO in contempt for allegedly violating a permanent injunction.
- The case follows the 2019 WhatsApp mass-hacking campaign that targeted more than 1,400 users.
- WhatsApp also took down NSO-linked test accounts and groups.
Meta-owned WhatsApp has revealed that it recently caught and disrupted new spear-phishing attempts linked to NSO Group, the spyware company behind Pegasus.
The company said the attempts were designed to trick targets into clicking malicious links that moved them outside WhatsApp to external websites. WhatsApp also said it caught NSO-linked test accounts and groups on its platform, which it has since taken down.
Now, WhatsApp is asking a federal court to hold NSO in contempt, claiming the activity violated a permanent injunction that barred the spyware maker from ever targeting WhatsApp and its users again.
“Today, we’re asking the court to hold NSO in contempt,” WhatsApp said in its official update.
The legal move builds on a years-long case that began after WhatsApp discovered a 2019 mass-hacking campaign. That campaign targeted more than 1,400 WhatsApp users, prompting the company to notify victims and sue NSO.
A jury previously ordered NSO to pay about $167 million in damages, though that figure was later reduced to $4 million. However, the permanent injunction against targeting WhatsApp and its users remained a major part of the ruling.
According to WhatsApp, the new activity resembled earlier “1-click” phishing campaigns tied to NSO. In such attacks, a single click on a malicious link can be enough to compromise a device or account, without the victim needing to enter credentials.
WhatsApp said the campaign was uncovered after it investigated user reports. The company has also shared threat indicators so people can check whether they may have been targeted across WhatsApp, text messages, email, or other platforms.
The official post listed three defanged malicious domains as indicators: ikhwancast, ghazacast, and fr24cast. WhatsApp also advised users to keep apps and devices updated, report suspicious activity, and enable stricter account settings if they believe they may be targeted by advanced cyberattacks.
The case is not just about one messaging app. It highlights the continuing challenge of commercial spyware, where powerful hacking tools are sold to government customers and later tied to surveillance of journalists, activists, dissidents, officials, and rights workers.
Topics for more insights:
The U.S. Commerce Department added NSO Group to its Entity List in 2021, saying NSO and Candiru supplied spyware to foreign governments that used it to target government officials, journalists, activists, academics, embassy workers, and others.
WhatsApp also framed the issue as a national security risk, arguing that restrictions on surveillance-for-hire firms should remain in place. The company said that if a business on the U.S. Entity List continues to defy U.S. courts, easing restrictions would put secure communications at risk.
The latest development also comes as 12 civil rights organizations, security researchers, privacy advocates, and digital rights experts have filed amicus briefs supporting Meta’s fight against NSO’s appeal of the permanent injunction.
