Meta-owned messaging giant WhatsApp has filed a contempt of court petition against spyware developer NSO Group after disrupting a fresh spear-phishing campaign targeting its users worldwide this week.
The messaging platform accused the Israeli surveillance firm of violating a permanent injunction that strictly prohibits NSO from targeting WhatsApp and its users. This latest legal escalation follows a history of countless cases of abuse linked to the spyware manufacturer globally.
How the New Spear-Phishing Campaign Unfolded
On Monday, the tech company announced it had successfully identified and blocked malicious spear-phishing attempts linked directly to NSO Group. The discovery followed an internal investigation triggered by user reports. According to WhatsApp, the attackers attempted to deceive targets into clicking malicious links designed to redirect them to external, compromised websites. The hackers also created dedicated test accounts and groups on the messaging platform, which have since been terminated.
Security analysts noted that the tactics mirrored a previous campaign where targets were tricked into clicking malicious links that silently installed NSO’s Pegasus spyware. A similar operation was reported in Jordan in 2024.
NSO Group did not respond to requests for comment regarding these latest allegations.
A History of Legal Violations and Injunctions
The newly discovered campaign directly violates a permanent injunction issued by a US court last year, which ordered NSO to cease all targeting of WhatsApp and its user base. This legal restriction resulted from a years-long lawsuit initiated by the messaging service.
The original legal battle was sparked by a massive 2019 cyberattack in which NSO targeted over 1,400 WhatsApp users. Upon discovering the breach, WhatsApp alerted affected individuals and sued the spyware manufacturer. While a jury initially ordered NSO to pay £130 million ($167 million) in damages, that figure was subsequently reduced to £3.1 million ($4 million).
The Global Crackdown on Commercial Spyware
Over the past decade, independent security researchers, journalists, and technology firms have exposed numerous instances where state-sponsored actors utilised NSO’s tools to compromise the mobile devices of journalists, political dissidents, and human rights defenders.
In response, the technology sector has intensified its defences. Companies are publicly exposing hacking operations, alerting compromised users, pursuing legal remedies, and deploying advanced security protocols—such as specialised opt-in lockdown modes—to shield vulnerable users from sophisticated government-grade surveillance.
var playerInstance_jwplayer_6a7a0b8fda542 = jwplayer( “jwplayer_6a7a0b8fda542” );
playerInstance_jwplayer_6a7a0b8fda542.setup({
playlist: “https://cdn.jwplayer.com/v2/media/lv0GaEwB”,
});
Simultaneously, international pressure on NSO has mounted. The US government placed the firm on an entity blocklist and enforced strict sanctions against rival spyware operations, including Intellexa and its leadership.
Last year, a consortium of US investors acquired NSO Group with the intention of rehabilitating its corporate image and lobbying Washington officials to lift the restrictive trade measures.
Despite NSO’s ongoing efforts to gain access to the lucrative American market, the US Commerce Department has maintained the company’s position on its trade blacklist.