WhatsApp disrupts new spyware campaign linked to NSO Group

On Monday, WhatsApp announced that it caught and disrupted spear phishing attempts linked to NSO Group. The messaging app maker, owned by Meta, is now seeking to hold NSO Group in contempt of court—a legal charge for violating a court order. WhatsApp alleges that the spyware maker violated a permanent injunction, which is a court order requiring a party to cease a specific action, by launching a new hacking campaign targeting its platform and users.

According to WhatsApp, the attackers used spear phishing—highly targeted phishing attacks—to trick users into clicking malicious links to drive them to external websites outside of WhatsApp. The campaign is similar to a phishing campaign reported in Jordan in 2024, which also relied on malicious links to infect targets with spyware. In addition to the links, WhatsApp stated, “We also caught them creating test accounts and groups on WhatsApp, which we took down.” NSO Group did not respond to a request for comment, according to TechCrunch.

The legal action stems from a 2019 mass-hacking campaign by NSO Group that targeted more than 1,400 WhatsApp users. Following the discovery, WhatsApp notified the victims and sued the spyware maker. A jury originally ordered NSO Group to pay $167 million in damages, though a court later reduced that amount to $4 million. The permanent injunction was established as part of this years-long lawsuit to bar NSO Group from targeting WhatsApp and its users.

NSO Group is a spyware maker that has been ensnared in countless cases of abuse all over the world. Over the last decade, security researchers, journalists, and tech companies have documented dozens of cases where government hackers used NSO’s spyware to target and hack the phones of journalists, dissidents, human rights workers, and political opponents. In response, the U.S. government has placed pressure on the firm by putting it on a blocklist—a U.S. Commerce Department list restricting trade—and has imposed sanctions on other spyware makers like Intellexa. Although a group of American investors purchased NSO Group last year with plans to lobby for the removal of these trade restrictions, the U.S. government has kept the company on its blocklist.

Why it matters

WhatsApp’s push for a contempt order represents a critical test of whether traditional legal injunctions can effectively restrain private spyware developers. The outcome will signal whether tech platforms can use court orders to protect their users all over the world from state-sponsored surveillance tools.