Meta Accuses NSO Group of Violating Court Order in New WhatsApp Targeting Allegations
Meta has asked a US court to hold NSO Group in contempt for allegedly targeting WhatsApp users again, violating a permanent injunction issued after a previous lawsuit.
Meta is seeking to have Israeli spyware firm NSO Group held in contempt of court, alleging that the company has once again targeted WhatsApp users, thereby violating a permanent injunction. The social media giant claims to have disrupted "NSO-linked social engineering attempts" following investigations into user reports.
According to Meta, these recent attempts involved luring targets into clicking malicious links that would redirect them to external websites. The company also noted the creation of test accounts and groups on the WhatsApp platform as part of these efforts. WhatsApp has publicly shared a list of domains associated with this alleged campaign, including ikhwancast[.]com, ghazacast[.]com, and fr24cast[.]com, and is providing indicators to help organizations detect related activities.
This latest development escalates the ongoing legal conflict between Meta and NSO Group. In December 2024, a US court found NSO Group liable for hacking WhatsApp users through its Pegasus spyware. A subsequent jury awarded Meta approximately $168 million in damages in May 2025. However, the judge later reduced the award to $4 million and simultaneously issued a permanent injunction prohibiting NSO Group from targeting WhatsApp or its user base.
Meta asserts that NSO Group has disregarded this court order. "Last year, WhatsApp made history by securing a landmark verdict and permanent injunction barring NSO Group... from targeting WhatsApp and its users ever again," the company stated. "Today, we're asking the court to hold them in contempt of that order."
While Meta provided limited technical specifics regarding the timing, scale, success rate, or direct attribution of the alleged operation to NSO, the company's stance on commercial spyware has hardened. Meta now frames such surveillance technology as a national security concern.
"When a malicious company on the US government's Entity List continues to defy US courts, existing restrictions must remain firmly in place," WhatsApp argued. "Easing them would undermine US national security and put American companies and billions of people worldwide who depend on secure communications at risk."
If Meta's accusations are substantiated, this incident suggests that legal defeats and court orders may not be sufficient deterrents for spyware vendors targeting high-value platforms and users. The ongoing legal battles highlight the persistent challenges in regulating the use of sophisticated surveillance technologies.
The situation underscores the complex interplay between national security interests, commercial surveillance, and the legal frameworks designed to govern them, particularly in the context of cross-border operations and advanced cyber capabilities.
WhatsApp has escalated its legal battle against NSO Group by filing a federal court contempt order. This new filing alleges that NSO has violated a prior court order prohibiting them from accessing WhatsApp's systems, specifically in relation to the deployment of Pegasus spyware via zero-click exploits.
WhatsApp has identified and disrupted a new spear-phishing campaign linked to NSO Group, accusing the spyware firm of violating a permanent injunction. The campaign attempted to lure fewer than 10 users in Jordan and Lebanon into clicking malicious links, though no successful compromises were detected. WhatsApp is petitioning the court to hold NSO in contempt for this alleged violation, citing NSO's continued development of exploit vectors.
Meta's complaint details specific actions by NSO Group, including attempts to trick users with malicious links and the creation of test accounts on WhatsApp, which Meta subsequently removed. These actions are described as resembling past spearphishing campaigns targeting journalists and activists, reinforcing Meta's argument that NSO Group continues to defy a court injunction.
WhatsApp has filed a federal court contempt order against NSO Group for allegedly violating a permanent injunction that prohibits the spyware maker from targeting WhatsApp users. The messaging app detected these new attacks, which used social engineering to trick users into clicking malicious links, after users reported suspicious activity. WhatsApp is urging the public to check for indicators of compromise across platforms, as NSO has also created and removed test accounts and groups on the platform.
Meta has detailed its disruption of recent social engineering attempts linked to NSO Group, which it claims violate a prior court order. The company stated that these attempts aimed to trick users into clicking malicious links outside of WhatsApp, similar to previous campaigns. Meta is now seeking to hold NSO Group in contempt of court for these alleged violations, citing the ongoing nature of the spyware vendor's activities despite legal injunctions.
Meta has announced it detected and blocked new spear-phishing attempts linked to NSO Group targeting WhatsApp users. The company is also filing a federal court contempt order against NSO Group for violating a prior permanent injunction that barred it from targeting WhatsApp and its users. The social media giant also reported catching NSO Group creating test accounts and groups on WhatsApp, which have since been taken down.
WhatsApp has detailed new spear-phishing campaigns attributed to the NSO Group that attempted to lure targets into clicking malicious links, a tactic similar to previously reported one-click phishing campaigns. The company also reported detecting and taking down NSO-created test accounts and groups on its platform, further alleging violations of a 2025 court order that issued a permanent injunction against the spyware vendor.
WhatsApp has revealed that the NSO Group is employing spearphishing tactics to target its users, a development that has prompted Meta to seek a contempt ruling against the surveillance firm. These new allegations suggest NSO Group may be violating a previous court order that prohibited its use of WhatsApp's services for surveillance purposes, escalating the ongoing legal battle between the two entities.
Bruce Schneier's analysis highlights that NSO Group's recent phishing activities against WhatsApp users represent a direct violation of a prior court order. This new information underscores the ongoing nature of NSO Group's alleged non-compliance and the continued scrutiny faced by the company regarding its surveillance operations.