WhatsApp says it caught new spyware attacks linked to NSO Group in violation of court order

WhatsApp has announced it has thwarted a recent hacking initiative associated with NSO Group, a notorious spyware developer implicated in numerous global abuse cases. The messaging platform has accused NSO of breaching a previous court ruling that prohibits the company from targeting WhatsApp and its users, and is now pursuing legal action to hold NSO in contempt of court. In a statement released on Monday, the Meta-owned platform revealed it had 'caught and disrupted spear phishing attempts linked to NSO' following user reports that triggered an investigation. The company detailed how the attackers attempted to deceive users into clicking on harmful links that directed them to malicious external sites. Furthermore, WhatsApp noted that the hackers had set up fake accounts and groups on the platform, all of which were promptly taken down. The nature of these recent attacks mirrors earlier phishing campaigns that aimed to infect victims with NSO's notorious Pegasus spyware, a tactic that had previously gained attention during a similar incident in Jordan in 2024. Despite reaching out, NSO did not provide any comments to TechCrunch regarding these allegations. This latest revelation comes on the heels of a long-standing lawsuit by WhatsApp against NSO, stemming from a significant hacking operation in 2019 that compromised over 1,400 users. Following the exposure of this incident, WhatsApp pursued legal action, resulting in a jury initially ordering NSO to pay $167 million in damages, although this was later reduced to $4 million. Over the past decade, the actions of NSO Group have been extensively documented, revealing the use of its spyware by government operatives to target journalists, activists, and political dissenters. In response, various tech companies have taken steps to address these threats, including public disclosures of hacking incidents, victim notifications, lawsuits against spyware manufacturers, and the introduction of enhanced security features designed to protect devices. The U.S. government has also intensified its scrutiny of NSO by placing the company on a sanctions list and implementing restrictions on other spyware firms like Intellexa. In a bid to rehabilitate its image, a consortium of U.S. investors acquired NSO last year, aiming to persuade the government to lift its sanctions. However, NSO's ambitions to penetrate the U.S. market remain hindered, as the company continues to be listed by the U.S. Commerce Department.