WhatsApp said that it disrupted a new hacking campaign linked to NSO Group, a spyware maker that has been ensnared in countless cases of abuse all over the world. The messaging app maker accused NSO of violating an earlier court order that bars the company from targeting WhatsApp and its users with its spyware, and is seeking to hold NSO in contempt of court.
On Monday, the Meta-owned chat app announced that it “caught and disrupted spear phishing attempts linked to NSO” after an investigation prompted by user reports. “They tried to trick people into clicking on malicious links to drive them to external websites outside of WhatsApp,” the company wrote. “We also caught them creating test accounts and groups on WhatsApp, which we took down.”
WhatsApp said that the attacks were similar to another phishing campaign that relied on users clicking on malicious links, which would then lead to the targets being infected with NSO’s spyware Pegasus, a campaign that was reported in Jordan in 2024.
NSO did not respond to TechCrunch’s request for comment.
Contact Us
Do you have more information about NSO Group? Or other spyware makers? We’d love to hear from you. From a non-work device and network, you can contact Lorenzo Franceschi-Bicchierai securely on Signal at +1 917 257 1382, or via Telegram and Keybase @lorenzofb, or email.
Last year, as part of a years-long lawsuit launched by WhatsApp against NSO, a court ordered the spyware maker to stop targeting WhatsApp and its users. WhatsApp claimed that the new phishing campaign revealed on Monday violated this permanent injunction, and as such filed a contempt order against NSO.
The injunction stems from a 2019 mass-hacking campaign by NSO that targeted more than 1,400 WhatsApp users. Following the discovery, WhatsApp notified the victims and sued the spyware maker. A jury ordered NSO to pay $167 million in damages, which were later lowered to $4 million.
Over the last decade, security researchers, journalists, and tech companies like WhatsApp, have documented dozens of cases where government hackers used NSO’s spyware to target and hack the phones of journalists, dissidents, human rights workers, and political opponents. Tech companies have responded in several ways: exposing these hacking campaigns publicly, notifying victims, filing lawsuits against the spyware makers, and launching new special opt-in security features designed to make devices and …