WhatsApp Reports Fresh Spyware Campaign Tied to NSO Group Despite Court Restrictions

WhatsApp has revealed that it recently disrupted a new cyberattack campaign connected to NSO Group, the controversial spyware company that has repeatedly faced allegations of enabling digital surveillance abuses worldwide. The messaging platform alleges that NSO violated a prior court order prohibiting it from targeting WhatsApp users with its spyware and is now asking the court to hold the firm in contempt.

On Monday, the Meta-owned messaging service disclosed that it had identified and stopped spear-phishing activities associated with NSO after launching an investigation in response to user-submitted reports. According to WhatsApp, the attackers attempted to deceive individuals into clicking malicious links that redirected them to websites outside the platform.

“We also identified the creation of test accounts and groups on WhatsApp as part of the operation, and we removed them,” the company said in a statement.

WhatsApp noted that the newly uncovered activity resembled another phishing campaign previously documented in Jordan in 2024. In that operation, victims were encouraged to click harmful links that ultimately led to the installation of NSO’s Pegasus spyware on their devices.

The latest allegations come after a lengthy legal battle between WhatsApp and NSO Group. Last year, a court issued a permanent injunction barring the spyware company from targeting WhatsApp and its users. WhatsApp argues that the newly disclosed campaign directly violates the injunction and has therefore filed a motion seeking to hold NSO in contempt of court.

The court order was the result of a 2019 hacking campaign carried out through WhatsApp that affected more than 1,400 users. After uncovering the operation, WhatsApp informed those impacted and initiated legal proceedings against NSO. A jury initially awarded $167 million in damages against the spyware company, though that amount was later reduced to $4 million.

Over the past decade, researchers, journalists, and technology firms, including WhatsApp, have documented numerous incidents in which government agencies allegedly used O’s Pegasus spyware to compromise the phones of journalists, dissidents, human rights advocates, and political rivals. In response, technology companies have publicly exposed such campaigns, alerted potential victims, pursued legal action against spyware vendors, and introduced advanced security protections to make devices and platforms more resistant to sophisticated government-backed surveillance tools.

Meanwhile, the U.S. government has increased pressure on NSO by placing the company on a trade-restriction list. Washington has similarly imposed sanctions on other spyware firms, including Intellexa and its founder.

Last year, a consortium of U.S. investors acquired NSO Group to repair the company’s image and lobby American officials to reconsider restrictions placed on the business.

Although NSO continues efforts to expand into the U.S. market, the company remains on the U.S. Commerce Department’s blocklist, and the government has not yet lifted the measures imposed against it.