Meta Blocks NSO Group's New WhatsApp Phishing Attack, Files Contempt Order
Meta says it blocked NSO Group-linked spear-phishing on WhatsApp and is seeking contempt sanctions for violating a court injunction.
Intelligence analysis by GPT-5.4 Mini
Meta says it spotted and stopped WhatsApp spear-phishing tied to NSO Group, including test accounts and malicious domains. It is also asking a U.S. court to hold NSO in contempt for violating a permanent injunction.
Meta says it stopped bad people from using WhatsApp links to trick users into a trap website, like baiting someone with a fake door. It is also asking a court to punish NSO Group for breaking earlier rules.
Analysis
What Meta says happened
Meta says it detected and blocked spear-phishing attempts linked to NSO Group, the Israeli spyware vendor best known for Pegasus. The company says the attackers tried to lure people into clicking malicious links that would send them to external websites outside WhatsApp.
Meta also says it found NSO Group creating test accounts and groups on WhatsApp, and that it took those accounts down. The article lists three domains tied to the activity: fr24cast[.]com, ghazacast[.]com, and ikhwancast[.]com.
Legal pressure is building
The move comes after a U.S. court previously found NSO Group had violated U.S. laws by exploiting WhatsApp servers to deploy Pegasus spyware against more than 1,400 people worldwide. The article says NSO was fined about $168 million in damages a year ago, and that the company was added to a U.S. Commerce Department blocklist in 2021.
Meta says it is now filing a federal court contempt order because NSO violated a permanent injunction that barred it from targeting WhatsApp and its users. That makes this more than a platform takedown story; it is also a compliance and enforcement dispute.
What users can do
Meta says WhatsApp messages and calls remain protected by default end-to-end encryption. It recommends keeping apps and devices updated, reporting suspicious activity, and, for people at higher risk, enabling strict account settings. Those controls turn on two-step verification, disable link previews, and limit profile visibility and group additions to known contacts or a pre-established list.
Key points
- Meta says it detected and blocked spear-phishing attempts linked to NSO Group on WhatsApp.
- The company says the attackers tried to send users to external malicious websites.
- Meta also says it found and removed NSO-created test accounts and groups on WhatsApp.
- Meta is asking a federal court to hold NSO in contempt for violating a permanent injunction.
- The article says WhatsApp users remain protected by default end-to-end encryption, and high-risk users can enable strict account settings.
If Meta’s blocking and legal action hold, it could make it harder for NSO-linked operators to use WhatsApp as a delivery path. People at higher risk can also lower exposure by turning on stricter account settings and keeping suspicious activity reported quickly.
NSO-linked operators may simply switch to new accounts, groups, or domains after one set of infrastructure is taken down. Even with court pressure, spear-phishing can keep targeting specific people by pushing them off WhatsApp to malicious sites.
