The Meta-owned platform said on Monday that it had uncovered and stopped a series of spear-phishing attempts linked to NSO after receiving reports from users.

According to WhatsApp, the attackers tried to lure targets into clicking malicious links that directed them to websites outside the app.

“They tried to trick people into clicking on malicious links to drive them to external websites outside of WhatsApp,” the company wrote. “We also caught them creating test accounts and groups on WhatsApp, which we took down.”

WhatsApp said the operation shared similarities with another campaign uncovered in Jordan in 2024. In that case, victims who clicked malicious links were infected with Pegasus, NSO Group’s spyware.

Following its latest findings, Meta has asked a US federal court to hold NSO in contempt, arguing that the company breached a permanent injunction issued during a long-running case between both firms.

The court order stemmed from a 2019 hacking campaign in which more than 1,400 WhatsApp users were targeted through the platform. After discovering the breach, WhatsApp alerted affected users and filed a lawsuit against NSO.

A jury later ordered the spyware maker to pay $167 million in damages. That amount was subsequently reduced to $4 million.

The latest court filing is another chapter in an issue that has lasted several years and drawn attention to the high use of commercial spyware around the world.

NSO Group has been repeatedly cautioned over Pegasus, a surveillance tool capable of infiltrating mobile devices through so-called “zero-click” and “one-click” attacks. 

Investigations by journalists, security researchers and technology companies have linked the spyware to operations targeting journalists, activists, dissidents, human rights defenders and political opponents in several countries.

WhatsApp said it has continually exposed suspected spyware campaigns, notified victims and strengthened protections for users who may face a higher risk of digital surveillance.

Other technology companies, including Apple and Google, have also introduced additional security measures designed to help protect users from advanced spyware attacks.

Meta’s latest legal action has attracted support from civil society groups. A coalition of 12 civil rights organisations, privacy advocates and security researchers has filed court briefs backing the company’s position and urging the court to maintain pressure on NSO.

The spyware maker is also still under pressure from the US government. NSO is still listed on the US Commerce Department’s Entity List, a designation that restricts its access to American technology.

Washington has imposed similar measures on other spyware firms, including Intellexa and its founder.

In 2025, a group of US investors acquired NSO and began efforts to rebuild the company’s reputation while seeking the removal of US restrictions. However, the company remains on the Commerce Department blocklist.

The NSO Group did not respond to requests for comment on the latest allegations from WhatsApp.

This follows thousands of questionable ads bypassing Meta’s screening process and appearing across Facebook and Instagram.

Between 1st and 14th January 2025 alone, CrushAI reportedly managed to push over 8,000 ads for its so-called “AI undresser” through Meta’s platforms. These ads linked users to sites that used artificial image manipulation to simulate nudity. 

Most of the app’s traffic, around 90%, according to Alexios Mantzarlis of the Faked Up newsletter, came directly from Meta-owned platforms.

The scale and frequency of these violations are not only a policy breach but a direct attack on user safety and digital dignity. Meta says it repeatedly removed these ads, but Joy Timeline HK continued, setting up new accounts and domains faster than the company could block them. 

In one case, ad accounts appeared under names like “Eraser Annyone’s Clothes” with a rotating list of numeric identifiers.

“I flagged several of these websites to Meta myself,” Mantzarlis wrote in January, highlighting how even public reporting didn’t immediately stop the flood of inappropriate content.

Meta’s frustration appears to have reached a boiling point. The lawsuit is a shift from internal enforcement to legal confrontation. It also notes a recognition that digital safety measures must evolve faster to deal with bad actors who are usually more agile and less bound by ethical or legal constraints.

These “nudify” tools have become a a challenge across the internet. Platforms like X, Reddit, YouTube, and even app stores have seen a surge in such services, with ads targeting users indiscriminately. 

TikTok and Meta have both banned search terms like “nudify” and “undress,” but policing this content has proven far more difficult in practice.

To stay ahead, Meta says it has built new detection systems capable of identifying problematic ads even when no explicit imagery is used. These systems use matching technology and a larger database of flagged terms and symbols to uncover deceptive ad content that previously went undetected.

The company is also disrupting coordinated ad networks. Since January 2025, Meta claims it has dismantled four major clusters of fake advertiser accounts promoting nudify services. These operations mirrored tactics used by disinformation and fraud networks, rapid domain switching, coordinated accounts, and evasion of AI filters.

“Today, we’ve filed a lawsuit against the entity behind CrushAI and are taking other steps to clamp down on nudify apps,” Meta said in a statement. “We have strict rules against non-consensual intimate imagery – whether it’s real or AI-generated – including the promotion of nudify apps.”

Meta has begun sharing intelligence with other tech companies through the Tech Coalition’s Lantern programme, a partnership involving platforms like Google and Snap to tackle child exploitation. Since March, Meta has supplied more than 3,800 offending URLs for review and takedown.

The firm is also lobbying for stronger legislative frameworks. In the U.S., Meta backed the Take It Down Act, which gives parents more control over app downloads and aims to limit children’s exposure to harmful tools.

The company says it’s working closely with lawmakers to put these measures into effect globally.