WhatsApp has announced that it has disrupted a new hacking campaign linked to spyware maker NSO Group, which has been involved in countless exploits around the world. The messaging app maker is seeking to hold NSO in contempt of court, accusing it of violating a previous court order barring it from targeting WhatsApp and its users with spyware.
The Meta-owned chat app announced on Monday that it had “captured and thwarted an NSO-related spear phishing attempt” after investigating reports from users. “They attempted to trick people into clicking on malicious links that directed them to external websites outside of WhatsApp,” the company wrote. “We also discovered that they had created test accounts and groups on WhatsApp, which we deleted.”
WhatsApp said the attack is similar to another phishing campaign that relied on users clicking on malicious links, leading to targets being infected with NSO's Pegasus spyware, which was reported in Jordan in 2024.
NSO did not respond to TechCrunch's request for comment.
Contact Us Do you have more information about NSO Group or other spyware manufacturers? We'd love to hear your thoughts. You can contact Lorenzo Franceschi-Bicchierai securely from any non-work device or network on Signal (+1 917 257 1382), Telegram and Keybase @lorenzofb, or email.
Last year, as part of a years-long lawsuit brought by WhatsApp against NSO, a court ordered the spyware maker to stop targeting WhatsApp and its users. WhatsApp claims that a new phishing campaign revealed on Monday violates this permanent injunction and has therefore filed a contempt order against NSO.
The injunction stems from a mass hacking campaign by NSO in 2019 that targeted over 1,400 WhatsApp users. After the discovery, WhatsApp notified the victims and filed a lawsuit against the spyware maker. The jury ordered NSO to pay $167 million in damages, which was later reduced to $4 million.
Over the past decade, security researchers, journalists, and tech companies like WhatsApp have documented dozens of incidents in which government hackers used NSO spyware to target and hack the cellphones of journalists, dissidents, human rights activists, and political opponents. Tech companies have responded in several ways. That means exposing these hacking campaigns to the public, notifying victims, filing lawsuits against spyware makers, and introducing new special opt-in security features designed to make it harder for government customers to hack their devices and apps, especially those equipped with powerful spyware like NSO's Pegasus.
At the same time, the US government put pressure on NSO by putting it on a blocklist and also imposed sanctions on other spyware makers like Intellexa and its founders.
A group of U.S. investors bought NSO last year in hopes of cleaning up the company's reputation and lobbying the U.S. government to lift measures against it.
Although NSO continues its plans to enter the US market, the US government has not yet removed NSO from the US Department of Commerce's block list.
If you buy through links in our articles, we may earn a small commission. This does not affect editorial independence.