WhatsApp said it has disrupted a new hacking campaign linked to spyware company NSO Group, accusing the Israeli firm of violating a court order that prohibits it from targeting the messaging platform and its users.
The Meta-owned service said Monday that it uncovered the activity after receiving reports from users.
According to WhatsApp, the attackers attempted to lure victims into clicking malicious links that redirected them to websites outside the app.
The company said it also identified and removed test accounts and groups created on WhatsApp.
Similar tactics to earlier Pegasus campaign
WhatsApp said the attacks resembled a phishing campaign reported in Jordan in 2024.
That operation relied on malicious links that ultimately infected victims’ devices with Pegasus, NSO’s spyware.
NSO did not respond to requests for comment.
WhatsApp seeks contempt ruling
The latest allegations stem from a years-long legal battle between WhatsApp and NSO.
Last year, a court issued a permanent injunction ordering NSO to stop targeting WhatsApp and its users.
WhatsApp said the newly uncovered campaign violated that order and has asked the court to hold NSO in contempt.
Lawsuit dates back to 2019
The legal dispute began after a 2019 hacking campaign that targeted more than 1,400 WhatsApp users.
Following the discovery, WhatsApp notified affected users and sued NSO.
A jury later awarded WhatsApp $167 million in damages, though the amount was subsequently reduced to $4 million.
Pegasus has been tied to numerous abuses
Over the past decade, researchers, journalists and technology companies have documented multiple cases involving Pegasus.
According to those investigations, government customers used the spyware to target:
- Journalists.
- Human rights activists.
- Dissidents.
- Political opponents.
Technology companies have responded by:
- Publicly exposing spyware campaigns.
- Notifying victims.
- Filing lawsuits against spyware vendors.
- Introducing enhanced security protections.
U.S. restrictions remain in place
The U.S. government has taken action against several spyware firms.
Measures against NSO include placement on a Commerce Department blocklist.
Washington has also sanctioned other spyware companies, including Intellexa and its founder.
Last year, a group of U.S. investors acquired NSO in an effort to rehabilitate the company’s reputation and push for the removal of government restrictions.
Despite those efforts, NSO remains on the Commerce Department’s blocklist.
TL;DR:
WhatsApp says it stopped a new phishing campaign linked to NSO Group and has asked a court to hold the spyware company in contempt, arguing the attacks violated an earlier order banning NSO from targeting WhatsApp users.
AI summary:
- WhatsApp says it disrupted new attacks linked to NSO Group.
- The company alleges NSO violated a court injunction.
- Attackers used phishing links similar to earlier Pegasus campaigns.
- The legal dispute dates back to a 2019 attack affecting 1,400 users.
- NSO remains on the U.S. Commerce Department’s blocklist.
