WhatsApp stated that it recently intercepted a new wave of attacks linked to Israeli spyware vendor NSO Group, which it believes violates a previous permanent injunction. The company is seeking to pursue charges of contempt of court against NSO.
The attack was launched via malicious links.
This investigation began with user reports. WhatsApp stated that attackers used targeted phishing to lure targets into clicking malicious links, which then redirected them to websites outside of WhatsApp. The company also discovered that the attackers had created test accounts and groups within the platform; these accounts and groups have since been removed.
WhatsApp stated that this operation is similar in method to an attack disclosed in Jordan in 2024. That attack also relied on malicious links, which, once clicked, could implant Pegasus, a spyware program owned by the NSO, into the device.
The court injunction has become the latest point of contention.
This dispute relates to years of litigation between the two parties. Last year, the court ordered NSO to cease monitoring or attacking WhatsApp and its users. WhatsApp believes that the newly discovered phishing attack violates this injunction and has therefore filed for contempt of court.
The ban stems from a massive hacking incident in 2019, in which over 1,400 WhatsApp users were targeted. WhatsApp notified the victims after discovering the attack and sued NSO. A jury initially awarded NSO $167 million in damages, which was later reduced to $4 million.
NSO remains on the U.S. restricted list.
Over the past decade, numerous tech companies, security researchers, and media outlets have consistently disclosed that government clients have used NSO's Pegasus to monitor journalists, dissidents, human rights activists, and political opponents. Tech companies typically publicize the attacks, notify victims, file lawsuits, and roll out more robust security features.
The U.S. government has also continued to pressure NSO, including adding it to the U.S. Department of Commerce's restricted list. The U.S. has also imposed sanctions on other spyware companies and their founders.
Additional information:The report states that a group of US investors acquired NSO last year in hopes of improving its reputation and pushing the US government to remove related restrictions. However, as of now, NSO has not been removed from the US Department of Commerce's restricted list.
