Loading story…
Meta’s WhatsApp said it will ask a U.S. court to hold NSO Group in contempt after alleging the spyware vendor again used WhatsApp infrastructure to target users with Pegasus spyware, despite a prior court order barring such activity. Citizen Lab said the new allegations point to continued targeted surveillance through messaging platforms, with researchers arguing the reported conduct strengthens the case for ongoing sanctions and further legal consequences against NSO.
The allegations fit a broader pattern in which Pegasus and similar mobile spyware have been delivered through zero-click chains in apps such as WhatsApp and iMessage, often leaving only limited forensic traces. Prior reporting and technical analysis have tied Pegasus to exploits including CVE-2019-3568, while later research highlighted newer WhatsApp- and Apple-related exploit chains, artifacts such as CASCADEFAIL, and the need for high-risk organizations to rely on mobile telemetry, network monitoring, forensic review, and protections such as Apple Lockdown Mode to detect or blunt sophisticated mobile intrusions.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
7 events from the most recent confirmed update back to the earliest known activity.
WhatsApp said NSO Group had again used WhatsApp to lure targets into downloading Pegasus spyware, conduct that Meta said violated a U.S. court order issued the previous year. Meta said it planned to ask a U.S. court to hold NSO in contempt over the alleged renewed abuse.
Codeby published an analysis of zero-click mobile exploitation chains involving Pegasus and Predator, including FORCEDENTRY, CASCADEFAIL, CVE-2019-3568, and the reported 2025 WhatsApp/ImageIO chain. The article argued that such attacks often evade enterprise EDR and recommended MDM telemetry, network analytics, and scheduled forensic analysis for high-risk devices.
A Codeby article reported on a 2025 Pegasus zero-click chain that allegedly combined WhatsApp flaw CVE-2025-55177 with Apple ImageIO flaw CVE-2025-43300 and said it had been exploited in the wild against targeted victims. The article framed the chain as part of broader analysis of Pegasus and Predator mobile exploitation techniques.
Bill Marczak published an analysis examining whether public evidence supported attribution of TRIANGULATION to the NSA and whether the "BackupAgent" artifact was specific enough to identify infections. The article compared the campaign with NSO Group and QuaDream operations and emphasized monitoring mobile traffic and messaging-app attack surfaces.
In June 2023, the TRIANGULATION iPhone spyware campaign was disclosed after the Russian FSB alleged NSA compromise of Apple devices in Russia and Kaspersky published forensic evidence of a real intrusion campaign. Kaspersky identified suspicious exfiltration from management devices and linked compromise timing to a process labeled "BackupAgent," which became a key forensic indicator.
Bill Marczak published a technical critique of the forensic claims around the alleged compromise of Jeff Bezos' iPhone after a WhatsApp video attachment reportedly sent by Mohammed bin Salman. He called for verification of the video file, decryption of the WhatsApp downloader artifact, and clarification of how outbound traffic spikes were derived from iOS forensic data.
Chronicle published an analysis arguing that GOSSIPGIRL is a collaborative "Supra Threat Actor" umbrella rather than a single actor, tying together platforms including Flame, Stuxnet, Duqu, and Equation. The piece also claimed discoveries including Stuxshop links, Duqu 1.5, and Flame 2.0 as a continuation beyond Flame's supposed shutdown.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
5 references tracked. Mallory keeps watching after this page renders.
citizenlab.ca
Open sourcecodeby.net
Open sourcemedium.com
Open sourcemedium.com
Open sourcemedium.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Meta said it disrupted a new **NSO Group-linked** operation that used **one-click phishing** against WhatsApp users and has asked a U.S. federal court to hold the spyware vendor in contempt for allegedly violating a permanent injunction. According to WhatsApp, the activity relied on malicious external links, social engineering, and WhatsApp test accounts and groups used to stage the attacks, echoing tactics previously associated with **Pegasus** spyware campaigns. Meta also published malicious domains and related indicators tied to the infrastructure and said it removed the accounts involved. The alleged targeting primarily affected fewer than 10 users in **Jordan and Lebanon**, and WhatsApp said it found no evidence of successful device compromise. The filing follows earlier court action over NSO’s 2019 campaign that exploited a WhatsApp **VOIP stack** buffer overflow to compromise about 1,400 users, a case that resulted in a jury award of more than **$167 million** in punitive damages plus compensatory damages and a court order barring NSO from targeting WhatsApp or its users. Meta said the new activity shows continued exploit development and spyware operations despite that injunction.
Jun 29, 2026
WhatsApp and parent company Meta won a major legal victory against **NSO Group** over the use of **Pegasus** spyware to hack roughly **1,400 users** through a WhatsApp audio-calling vulnerability. The case, filed in 2019, survived NSO’s attempts to dismiss it, including arguments that it should share sovereign immunity with its government customers, and the **U.S. Supreme Court** later allowed the suit to proceed. A court subsequently found NSO liable for violating the **Computer Fraud and Abuse Act**, California anti-hacking law, and WhatsApp’s terms of service, and a jury later awarded WhatsApp more than **$167 million** in damages. Court proceedings and later reporting exposed new details about the spyware operation and NSO’s conduct during discovery. Trial evidence described a **zero-click** Pegasus delivery chain using a fake WhatsApp call and infrastructure designed to infect targets using only a phone number, and testimony indicated NSO continued developing WhatsApp-based vectors after the lawsuit began under codenames including **Eden**, **Heaven**, **Erised**, and **Hummingbird**. Separate reporting alleged NSO sought Israeli government help to keep Pegasus source code and malware documents out of U.S. court, leading to a secret seizure of internal files, while disclosures in the case identified customers including **Mexico, Saudi Arabia, and Uzbekistan** and reinforced longstanding allegations that Pegasus had been used against journalists, activists, and other civil society targets.
Jun 29, 2026
NSO Group has filed an appeal to overturn a U.S. federal court's permanent injunction that prohibits the company from targeting WhatsApp with its Pegasus spyware. The injunction, issued by Judge Phyllis Hamilton in the Northern District of California, found that NSO Group had improperly used WhatsApp's infrastructure to target approximately 1,400 users with zero-click exploits. NSO argues that the ruling misapplies the Computer Fraud and Abuse Act (CFAA) and mischaracterizes how Pegasus operates, claiming that the order could force the company out of business and disrupt law enforcement and intelligence operations that rely on its technology. In its motion to stay the injunction pending appeal, NSO Group emphasized the "catastrophic" and "irreparable" harm the order would cause, including the requirement to destroy code that interacts with WhatsApp. The company also contends that the injunction would prevent it from engaging in lawful business activities, such as developing and licensing products for authorized government investigations, while leaving competitors unaffected. NSO has recently appointed a former U.S. envoy to Israel as executive chairman and confirmed new U.S. investors, underscoring the high stakes of the legal battle for its future operations and partnerships.
Jun 29, 2026