Meta has asked a US federal court to hold Israeli spyware company NSO Group in contempt, alleging that the firm allowed its Pegasus surveillance technology to be deployed against WhatsApp users through a spear-phishing campaign that it says directly violates a judicial order issued last year expressly prohibiting such activity.
WhatsApp Says NSO Group Violated Court Order by Linking Its Pegasus Technology to Malicious Links Sent to Users
The contempt motion, announced via a on Monday, follows the detection of malicious links on the messaging platform that the company has attributed to NSO Group’s technology.
Theshared links were designed to redirect users to websites operating outside of WhatsApp, according to a company spokesperson, in what security researchers describe as a spear-phishing attack — a targeted form of digital deception aimed at specific individuals rather than a broad population.
WhatsApp said it had disrupted the campaign before any devices were compromised. The company said it became aware of the attempts after prospective targets independently reported the suspicious activity to the platform.
Meta did not identify which of NSO Group’s government clients it believed had authorised the campaign.
NSO Pegasus Phishing Campaign Targeted Fewer Than 10 WhatsApp Users, Mostly in Jordan and Lebanon
The operation was limited in scope. Fewer than 10 WhatsApp users were targeted, the majority of them based in Jordan and Lebanon, a Meta representative confirmed.
Among the domain links shared by the company as evidence of the campaign was one constructed to impersonate France 24, the Paris-based state-owned international news and television network.
Meta declined to identify the individuals targeted or provide further details about the accounts involved.
NSO Group Already Faces a Federal Injunction Barring It From Targeting WhatsApp
The contempt allegation sits within the context of an existing federal court order that expressly prohibits NSO Group from accessing WhatsApp’s systems or targeting its users.
That injunction followed a landmark verdict last May in which a federal jury ordered to resolve a six-year legal dispute, after NSO used its Pegasus software to compromise approximately 1,400 WhatsApp accounts belonging to journalists, human rights advocates and government officials across 20 countries in a 2019 campaign.
The damages figure was subsequently reduced to $4 million.
NSO Group is currently appealing the court injunction.
NSO Group Defends Pegasus as a Tool for Governments Fighting Crime and Terrorism but Investigations Say Otherwise
NSO Group has long argued that it sells its surveillance capabilities exclusively to vetted government clients for the purpose of combating serious crime and terrorism, a position the company has maintained consistently across multiple legal and regulatory challenges.
That defence has been repeatedly contradicted by independent investigations, which have documented the deployment of Pegasus by governments in Mexico and across the Middle East to monitor journalists, political dissidents and human rights workers.
has also been linked to what researchers call zero-click attacks, a form of compromise that requires no action from the target whatsoever.
Biden Administration Placed NSO Group on the US Entity List in 2021 for Acting Against National Security Interests
The Biden administration sanctioned NSO Group in 2021, adding the company to the US government’s entity list and barring American firms from supplying it with technology or services.
US officials said the decision was necessary to counter a largely ungoverned global market for commercial spyware that foreign governments had been using to track critics and suppress political opposition.
The designation was widely seen as a sharp break at the time, given the close security relationship between the US and Israel.
NSO Group has sought to reverse the designation without success.
Meta Says NSO Must Stay on the US Entity List
In its blog post, Meta argued that the newly identified activity made the case for maintaining NSO Group’s current restrictions. “When a malicious company on the US government’s entity list continues to defy US courts, existing restrictions must remain firmly in place,” the company said.
“Easing them would undermine US national security and put American companies and billions of people worldwide who depend on secure communications at risk.”
WhatsApp has also published the threat indicators linked to the campaign so that other platforms can assess whether their own users were targeted by the same operation.
US Investors Including Hollywood Producer Robert Simonds Acquired a Controlling Stake in NSO Group Late Last Year
The contempt proceedings come after a notable shift in NSO Group’s ownership structure. A group of US investors, including Hollywood producer Robert Simonds, purchased a controlling stake in the Israeli company late last year, a development that drew considerable attention given NSO’s longstanding conflicts with American regulators, courts and technology companies.
