Loading story…
A U.S. federal judge has issued a permanent injunction prohibiting the NSO Group, an Israeli spyware company, from targeting or infecting WhatsApp users with its Pegasus spyware. The ruling, delivered by Judge Phyllis J. Hamilton of the Northern District of California, stems from a lawsuit filed by Meta, WhatsApp's parent company, in 2019 after NSO was discovered attempting to compromise approximately 1,400 WhatsApp users, including attorneys, journalists, human rights activists, political dissidents, diplomats, and senior government officials. NSO's campaign involved creating fake WhatsApp accounts and targeting Meta's infrastructure to deploy Pegasus, a sophisticated zero-click spyware tool known for exploiting vulnerabilities in widely used software. The court found that NSO's actions caused direct business harm to Meta by undermining the privacy and security assurances that WhatsApp offers its users, particularly its end-to-end encryption based on the Signal Protocol. Judge Hamilton emphasized that unauthorized access to users' personal information constitutes more than reputational damage; it directly interferes with the core service Meta provides. In addition to the injunction, the court ordered NSO to delete any data obtained from targeting WhatsApp users. The judge also reduced the punitive damages awarded to Meta from $167 million to $4 million, citing legal precedents regarding the proportionality of damages to the conduct in question. While NSO argued that the injunction could force it out of business, the company stated that the ruling does not apply to its customers, who may continue using its technology, though legal experts and advocates for spyware victims dispute this interpretation. The decision is seen as a significant precedent for technology companies seeking to protect their platforms from commercial spyware and unlawful surveillance. Will Cathcart, head of WhatsApp, celebrated the ruling as a victory for user privacy and a warning to those who attempt to circumvent encryption protections. The case highlights the ongoing legal and ethical challenges posed by commercial spyware vendors and the importance of judicial intervention in safeguarding digital privacy. The ruling is the culmination of six years of litigation and is expected to influence future cases involving unlawful electronic surveillance. NSO Group, recently acquired by a consortium led by Hollywood producer Robert Simonds, is reviewing the decision but welcomed the reduction in damages. Privacy advocates have praised the court's recognition of the irreparable harm caused by circumventing end-to-end encryption and the broader implications for protecting civil society from targeted surveillance.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
In the same ruling, the judge sharply reduced punitive damages against NSO Group from $167.3 million to $4 million, citing legal precedent on acceptable punitive-to-conduct ratios. NSO welcomed the reduction while noting the injunction was limited to WhatsApp and did not apply to its customers.
A U.S. federal judge in Northern California granted WhatsApp a permanent injunction prohibiting NSO Group from targeting WhatsApp and its users with spyware. The court found that attacks on WhatsApp's end-to-end encryption and privacy commitments caused fundamental harm to Meta's business and user trust.
Before the latest ruling, a court awarded Meta/WhatsApp $167.3 million in damages in the spyware case against NSO Group. This amount later became the basis for judicial review of the punitive damages ratio.
WhatsApp initiated litigation against NSO Group over the use of Pegasus spyware to target WhatsApp users, beginning a legal battle that would last about six years. The case centered on attacks that affected civil society targets and undermined WhatsApp's security protections.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
arstechnica.com
Open sourcetherecord.media
Open sourcecyberscoop.com
Open sourcescworld.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A U.S. federal judge has issued a permanent injunction against the Israeli spyware vendor NSO Group, prohibiting the company from using its technology to hack WhatsApp, one of the world's most widely used encrypted messaging applications. The court found that NSO Group had illegally reverse-engineered WhatsApp using a zero-day exploit, which resulted in the compromise of approximately 1,400 user devices. This exploit allowed unauthorized access to personal information, undermining the security and privacy of WhatsApp users globally. The case was brought before the U.S. District Court for the Northern District of California, where Judge Phyllis Hamilton presided over the proceedings. A California jury previously determined that NSO Group's actions constituted a breach, and initially awarded $167 million in punitive damages to Meta, WhatsApp's parent company. NSO Group appealed the ruling, arguing that the damages were excessive and that the injunction would effectively shut down its operations. In her final order, Judge Hamilton reduced the damages to $4 million but maintained the permanent injunction, emphasizing the broader harm caused by unauthorized access to encrypted personal information. The court's decision also requires NSO Group to destroy any code used in the WhatsApp hack, further limiting the company's ability to conduct similar operations in the future. Meta representatives welcomed the verdict, describing it as a significant advancement for user privacy and security. The ruling highlighted NSO Group's alleged role in enabling governments to target dissidents, political opponents, and journalists through its spyware. The case underscores the legal and ethical challenges posed by commercial spyware vendors and their impact on global digital privacy. The court's findings reinforce the importance of robust encryption and the need for legal protections against unauthorized surveillance. The decision sets a precedent for holding spyware vendors accountable for facilitating unauthorized access to secure communications platforms. The outcome of this litigation may influence future regulatory and legal actions against similar companies. The case also demonstrates the willingness of U.S. courts to intervene in matters involving foreign technology firms and the protection of user data. The permanent injunction serves as a warning to other entities considering the development or deployment of similar surveillance tools. The legal battle between Meta and NSO Group has drawn international attention to the risks associated with commercial spyware and the necessity of safeguarding encrypted communications.
Jun 29, 2026
NSO Group has filed an appeal to overturn a U.S. federal court's permanent injunction that prohibits the company from targeting WhatsApp with its Pegasus spyware. The injunction, issued by Judge Phyllis Hamilton in the Northern District of California, found that NSO Group had improperly used WhatsApp's infrastructure to target approximately 1,400 users with zero-click exploits. NSO argues that the ruling misapplies the Computer Fraud and Abuse Act (CFAA) and mischaracterizes how Pegasus operates, claiming that the order could force the company out of business and disrupt law enforcement and intelligence operations that rely on its technology. In its motion to stay the injunction pending appeal, NSO Group emphasized the "catastrophic" and "irreparable" harm the order would cause, including the requirement to destroy code that interacts with WhatsApp. The company also contends that the injunction would prevent it from engaging in lawful business activities, such as developing and licensing products for authorized government investigations, while leaving competitors unaffected. NSO has recently appointed a former U.S. envoy to Israel as executive chairman and confirmed new U.S. investors, underscoring the high stakes of the legal battle for its future operations and partnerships.
Jun 29, 2026
WhatsApp and parent company Meta won a major legal victory against **NSO Group** over the use of **Pegasus** spyware to hack roughly **1,400 users** through a WhatsApp audio-calling vulnerability. The case, filed in 2019, survived NSO’s attempts to dismiss it, including arguments that it should share sovereign immunity with its government customers, and the **U.S. Supreme Court** later allowed the suit to proceed. A court subsequently found NSO liable for violating the **Computer Fraud and Abuse Act**, California anti-hacking law, and WhatsApp’s terms of service, and a jury later awarded WhatsApp more than **$167 million** in damages. Court proceedings and later reporting exposed new details about the spyware operation and NSO’s conduct during discovery. Trial evidence described a **zero-click** Pegasus delivery chain using a fake WhatsApp call and infrastructure designed to infect targets using only a phone number, and testimony indicated NSO continued developing WhatsApp-based vectors after the lawsuit began under codenames including **Eden**, **Heaven**, **Erised**, and **Hummingbird**. Separate reporting alleged NSO sought Israeli government help to keep Pegasus source code and malware documents out of U.S. court, leading to a secret seizure of internal files, while disclosures in the case identified customers including **Mexico, Saudi Arabia, and Uzbekistan** and reinforced longstanding allegations that Pegasus had been used against journalists, activists, and other civil society targets.
Jun 29, 2026