WhatsApp says it caught new spyware attacks linked to NSO Group in violation of court order
WhatsApp says it disrupted a new phishing campaign tied to NSO Group and is asking a court to treat it as a violation of an existing injunction.
Intelligence analysis by GPT-5.4 Mini
WhatsApp says user reports helped it uncover spear-phishing attempts linked to NSO Group, including malicious links and fake accounts and groups. The company says the activity breaches a court order that bars NSO from targeting WhatsApp users, and it is seeking a contempt ruling.
WhatsApp says some bad actors tried to trick people with fake links, like bait in a fishing hook, and it thinks the group behind it was NSO. WhatsApp blocked the tricks and is asking a judge to punish NSO for breaking a court rule.
Analysis
What WhatsApp says happened
WhatsApp says it identified and disrupted a new hacking campaign linked to NSO Group after users reported suspicious activity. According to the company, the attackers tried to lure people into clicking malicious links that would send them to external sites outside WhatsApp. It also said it found and removed test accounts and groups created on the app as part of the effort.
Why NSO is back in court
The company says the campaign looks similar to a previous phishing effort that led to Pegasus infections in Jordan in 2024. That matters because a court had already ordered NSO to stop targeting WhatsApp and its users. WhatsApp now says the new activity violates that permanent injunction and is asking the court to hold NSO in contempt.
Bigger context
The dispute sits inside a much larger story about commercial spyware. Over the past decade, researchers, journalists, and tech companies have linked NSO's tools to attacks on journalists, dissidents, human rights workers, and political opponents. WhatsApp has responded before by notifying victims, exposing the campaign, and suing the company. The earlier 2019 mass-hacking campaign targeted more than 1,400 WhatsApp users, which led to damages being awarded to WhatsApp, later reduced from $167 million to $4 million.
The article also notes broader pressure on NSO from the U.S. government, including a Commerce Department blocklist, while a group of U.S. investors reportedly bought NSO last year and hoped to improve its standing and push for relief from U.S. restrictions. For now, though, the company remains blocked, and WhatsApp says the abuse has continued despite the court order.
Key points
- WhatsApp says it disrupted a new phishing campaign linked to NSO Group.
- The company says the attacks used malicious links and fake WhatsApp accounts and groups.
- WhatsApp argues the activity violates a court order that barred NSO from targeting its users.
- The dispute traces back to a 2019 campaign that hit more than 1,400 WhatsApp users.
- NSO remains under U.S. government pressure, including a Commerce Department blocklist.
If WhatsApp's response holds, more users may be warned before they are tricked, and the company can keep removing fake accounts and groups faster. A contempt ruling could also strengthen enforcement of the existing court order against NSO.
If the campaign is part of a wider pattern, similar attacks may keep appearing even after takedowns and lawsuits. The article also suggests that legal pressure alone has not stopped NSO-linked activity, which limits how much protection court orders can provide on their own.
