Meta alleges NSO violated spyware injunction with new WhatsApp attacks

Meta today accused spyware maker NSO Group of violating a court order that barred it from targeting users of WhatsApp. “WhatsApp caught and disrupted spear phishing attempts linked to NSO, a spyware firm blacklisted by the US government,” WhatsApp owner Meta said in an announcement. Meta said it is asking a court “to hold NSO in contempt for violating a permanent injunction that barred them from ever targeting WhatsApp and its users.” NSO is an Israeli company that developed the Pegasus spyware. The US government added NSO to the Entity List in 2021, saying it “developed and supplied spyware to foreign governments that used this tool to maliciously target government officials, journalists, businesspeople, activists, academics, and embassy workers.” WhatsApp won a permanent injunction against NSO last year in US District Court for the Northern District of California, and a jury awarded WhatsApp over $167 million in damages. A federal judge reduced the award to $4 million but granted the injunction, which NSO has since been trying to overturn. NSO complained in a court filing that “the injunction jeopardizes NSO’s principal product, Pegasus, which represented 100 percent of NSO’s sales in 2025.” The district court denied NSO’s motion to stay the injunction, and NSO has appealed to the US Court of Appeals for the 9th Circuit. Today, Meta said it caught NSO violating the court order. “We successfully disrupted NSO-linked social engineering attempts, after investigating user reports,” Meta said today. “They tried to trick people into clicking on malicious links to drive them to external websites outside of WhatsApp, similar to previously reported 1-click phishing campaigns linked to NSO. We also caught them creating test accounts and groups on WhatsApp, which we took down.”