Loading story…
Meta said it disrupted a new NSO Group-linked operation that used one-click phishing against WhatsApp users and has asked a U.S. federal court to hold the spyware vendor in contempt for allegedly violating a permanent injunction. According to WhatsApp, the activity relied on malicious external links, social engineering, and WhatsApp test accounts and groups used to stage the attacks, echoing tactics previously associated with Pegasus spyware campaigns. Meta also published malicious domains and related indicators tied to the infrastructure and said it removed the accounts involved.
The alleged targeting primarily affected fewer than 10 users in Jordan and Lebanon, and WhatsApp said it found no evidence of successful device compromise. The filing follows earlier court action over NSO’s 2019 campaign that exploited a WhatsApp VOIP stack buffer overflow to compromise about 1,400 users, a case that resulted in a jury award of more than $167 million in punitive damages plus compensatory damages and a court order barring NSO from targeting WhatsApp or its users. Meta said the new activity shows continued exploit development and spyware operations despite that injunction.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
After disrupting the alleged campaign, Meta asked a U.S. federal judge to hold NSO Group in contempt for allegedly violating the permanent injunction. Meta also published malicious domains and related indicators tied to the phishing infrastructure.
Meta said WhatsApp disrupted a new spear-phishing operation linked to NSO Group that used one-click phishing via malicious external links and WhatsApp test accounts and groups. The activity primarily targeted fewer than 10 users in Jordan and Lebanon, and WhatsApp said it found no evidence of successful device compromise.
Following the liability finding and damages verdict, a permanent injunction barred NSO Group from targeting WhatsApp or its users. Meta later alleged NSO violated this order through a new phishing operation.
In May 2025, a jury verdict ordered NSO Group to pay more than $167 million in punitive damages and $444,719 in compensatory damages over the 2019 Pegasus spyware campaign that compromised about 1,400 WhatsApp users.
A U.S. court found NSO Group liable for hacking WhatsApp users with Pegasus spyware. This ruling is described as having occurred in December 2024 and preceded a later permanent injunction.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
16 references tracked. Mallory keeps watching after this page renders.
schneier.com
Open sourcexakep.ru
Open sourcetheguardian.com
Open sourcehackread.com
Open sourcetechcrunch.com
Open sourcetherecord.media
Open sourcebleepingcomputer.com
Open sourcetheregister.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Meta’s WhatsApp said it will ask a U.S. court to hold **NSO Group** in contempt after alleging the spyware vendor again used WhatsApp infrastructure to target users with **Pegasus** spyware, despite a prior court order barring such activity. Citizen Lab said the new allegations point to continued targeted surveillance through messaging platforms, with researchers arguing the reported conduct strengthens the case for ongoing sanctions and further legal consequences against NSO. The allegations fit a broader pattern in which Pegasus and similar mobile spyware have been delivered through **zero-click** chains in apps such as WhatsApp and iMessage, often leaving only limited forensic traces. Prior reporting and technical analysis have tied Pegasus to exploits including `CVE-2019-3568`, while later research highlighted newer WhatsApp- and Apple-related exploit chains, artifacts such as **CASCADEFAIL**, and the need for high-risk organizations to rely on mobile telemetry, network monitoring, forensic review, and protections such as Apple **Lockdown Mode** to detect or blunt sophisticated mobile intrusions.
Jun 29, 2026
A U.S. federal judge has issued a permanent injunction against the Israeli spyware vendor NSO Group, prohibiting the company from using its technology to hack WhatsApp, one of the world's most widely used encrypted messaging applications. The court found that NSO Group had illegally reverse-engineered WhatsApp using a zero-day exploit, which resulted in the compromise of approximately 1,400 user devices. This exploit allowed unauthorized access to personal information, undermining the security and privacy of WhatsApp users globally. The case was brought before the U.S. District Court for the Northern District of California, where Judge Phyllis Hamilton presided over the proceedings. A California jury previously determined that NSO Group's actions constituted a breach, and initially awarded $167 million in punitive damages to Meta, WhatsApp's parent company. NSO Group appealed the ruling, arguing that the damages were excessive and that the injunction would effectively shut down its operations. In her final order, Judge Hamilton reduced the damages to $4 million but maintained the permanent injunction, emphasizing the broader harm caused by unauthorized access to encrypted personal information. The court's decision also requires NSO Group to destroy any code used in the WhatsApp hack, further limiting the company's ability to conduct similar operations in the future. Meta representatives welcomed the verdict, describing it as a significant advancement for user privacy and security. The ruling highlighted NSO Group's alleged role in enabling governments to target dissidents, political opponents, and journalists through its spyware. The case underscores the legal and ethical challenges posed by commercial spyware vendors and their impact on global digital privacy. The court's findings reinforce the importance of robust encryption and the need for legal protections against unauthorized surveillance. The decision sets a precedent for holding spyware vendors accountable for facilitating unauthorized access to secure communications platforms. The outcome of this litigation may influence future regulatory and legal actions against similar companies. The case also demonstrates the willingness of U.S. courts to intervene in matters involving foreign technology firms and the protection of user data. The permanent injunction serves as a warning to other entities considering the development or deployment of similar surveillance tools. The legal battle between Meta and NSO Group has drawn international attention to the risks associated with commercial spyware and the necessity of safeguarding encrypted communications.
Jun 29, 2026
WhatsApp and parent company Meta won a major legal victory against **NSO Group** over the use of **Pegasus** spyware to hack roughly **1,400 users** through a WhatsApp audio-calling vulnerability. The case, filed in 2019, survived NSO’s attempts to dismiss it, including arguments that it should share sovereign immunity with its government customers, and the **U.S. Supreme Court** later allowed the suit to proceed. A court subsequently found NSO liable for violating the **Computer Fraud and Abuse Act**, California anti-hacking law, and WhatsApp’s terms of service, and a jury later awarded WhatsApp more than **$167 million** in damages. Court proceedings and later reporting exposed new details about the spyware operation and NSO’s conduct during discovery. Trial evidence described a **zero-click** Pegasus delivery chain using a fake WhatsApp call and infrastructure designed to infect targets using only a phone number, and testimony indicated NSO continued developing WhatsApp-based vectors after the lawsuit began under codenames including **Eden**, **Heaven**, **Erised**, and **Hummingbird**. Separate reporting alleged NSO sought Israeli government help to keep Pegasus source code and malware documents out of U.S. court, leading to a secret seizure of internal files, while disclosures in the case identified customers including **Mexico, Saudi Arabia, and Uzbekistan** and reinforced longstanding allegations that Pegasus had been used against journalists, activists, and other civil society targets.
Jun 29, 2026