The Meta-owned platform said on Monday that it had uncovered and stopped a series of spear-phishing attempts linked to NSO after receiving reports from users.

According to WhatsApp, the attackers tried to lure targets into clicking malicious links that directed them to websites outside the app.

“They tried to trick people into clicking on malicious links to drive them to external websites outside of WhatsApp,” the company wrote. “We also caught them creating test accounts and groups on WhatsApp, which we took down.”

WhatsApp said the operation shared similarities with another campaign uncovered in Jordan in 2024. In that case, victims who clicked malicious links were infected with Pegasus, NSO Group’s spyware.

Following its latest findings, Meta has asked a US federal court to hold NSO in contempt, arguing that the company breached a permanent injunction issued during a long-running case between both firms.

The court order stemmed from a 2019 hacking campaign in which more than 1,400 WhatsApp users were targeted through the platform. After discovering the breach, WhatsApp alerted affected users and filed a lawsuit against NSO.

A jury later ordered the spyware maker to pay $167 million in damages. That amount was subsequently reduced to $4 million.

The latest court filing is another chapter in an issue that has lasted several years and drawn attention to the high use of commercial spyware around the world.

NSO Group has been repeatedly cautioned over Pegasus, a surveillance tool capable of infiltrating mobile devices through so-called “zero-click” and “one-click” attacks. 

Investigations by journalists, security researchers and technology companies have linked the spyware to operations targeting journalists, activists, dissidents, human rights defenders and political opponents in several countries.

WhatsApp said it has continually exposed suspected spyware campaigns, notified victims and strengthened protections for users who may face a higher risk of digital surveillance.

Other technology companies, including Apple and Google, have also introduced additional security measures designed to help protect users from advanced spyware attacks.

Meta’s latest legal action has attracted support from civil society groups. A coalition of 12 civil rights organisations, privacy advocates and security researchers has filed court briefs backing the company’s position and urging the court to maintain pressure on NSO.

The spyware maker is also still under pressure from the US government. NSO is still listed on the US Commerce Department’s Entity List, a designation that restricts its access to American technology.

Washington has imposed similar measures on other spyware firms, including Intellexa and its founder.

In 2025, a group of US investors acquired NSO and began efforts to rebuild the company’s reputation while seeking the removal of US restrictions. However, the company remains on the Commerce Department blocklist.

The NSO Group did not respond to requests for comment on the latest allegations from WhatsApp.

The decision comes after five years of courtroom appearances led by NSO’s covert use of its surveillance tool, Pegasus, to exploit a vulnerability in the messaging app.

The judgment, delivered in a California federal court, includes $167,254,000 in punitive damages and an additional $444,719 in compensatory payments to cover the disruption caused to WhatsApp’s operations.

For the Meta-owned company, this is a rare legal blow to a spyware vendor with a long history of enabling government surveillance against journalists, dissidents, and civil society figures.

In a direct response to the ruling, WhatsApp’s spokesperson Zade Alsawah stated: “Our court case has made history as the first victory against illegal spyware that threatens the safety and privacy of everyone.”

The 2019 breach, which exploited WhatsApp’s call feature, allowed Pegasus to infiltrate users’ devices even if the call wasn’t answered. Victims were spread across at least 20 countries and included human rights activists, journalists, and government officials.

Meta’s legal team argued that NSO Group not only violated state and federal laws but also breached WhatsApp’s terms of service, which explicitly prohibit malicious access.

The judge in the case, Phyllis Hamilton, had already ruled in December that NSO was legally liable, and this week’s verdict focused solely on damages.

The outcome may resonate far beyond WhatsApp or Meta. As the trial unfolded, the inner workings of NSO Group’s operations were exposed, including client lists and the extent of its surveillance infrastructure.

Will Cathcart, the head of WhatsApp, had previously warned: “This should serve as a wake-up call for technology companies, governments and all Internet users. Tools that enable surveillance into our private lives are being abused, and the proliferation of this technology into the hands of irresponsible companies and governments puts us all at risk.”

Despite the scale of the damages, NSO Group has not backed down. Its spokesperson, Gil Lainer, suggested the company would not accept the decision quietly: “We will carefully examine the verdict’s details and pursue appropriate legal remedies, including further proceedings and an appeal.”

NSO has consistently argued that its spyware serves national security interests by assisting governments in tackling crime and terrorism.

But critics reject this defence. John Scott-Railton, a senior researcher at Citizen Lab and long-time investigator of NSO, described the ruling as a turning point:

“NSO makes many millions of dollars helping dictators hack people. After years of every trick and delay tactic, it only took the jury a day’s deliberation to see right through to the heart of the matter: NSO’s business is based on hacking American companies…so that dictators can hack dissidents.”

He added: “The company emerges from this trial severely damaged. Aside from the huge punitive damages, the bigger impact of this case has also been a huge blow to NSO’s efforts to hide their business activities.”

Meta has indicated that the damages will be channelled to organisations working to defend digital rights and protect users against invasive surveillance.

This case with WhatsApp may not be the last challenge for NSO Group. The U.S. Commerce Department had already sanctioned the company in 2021, and tech giants like Apple have pursued similar legal action. 

The lawsuit, filed by WhatsApp’s parent company Meta in 2019, accused NSO of exploiting an audio-calling vulnerability to infiltrate 1,400 devices across 20 countries. 

The victims included journalists, human rights activists, and political dissidents. Judge Phyllis Hamilton, presiding over the case in California, ruled that NSO breached state and federal hacking laws as well as WhatsApp’s terms of service, which forbid malicious activities on its platform.

Judge Hamilton stated that NSO must have reverse-engineered WhatsApp’s software to carry out its attacks, despite questions about whether the company had agreed to the platform’s terms of service. 

The judge also cautioned NSO for failing to comply with court orders to produce apt evidence, such as the Pegasus spyware’s source code and internal communications about WhatsApp’s vulnerabilities. This lack of cooperation, she noted, sabotaged the transparency of NSO’s defence.

Meta’s representatives, including Emily Westcott, a spokesperson for WhatsApp, described the decision as a clear warning to spyware firms.

“NSO can no longer escape accountability for their illegal attacks on our platform and on civil society,” she said, adding that WhatsApp remains focused on safeguarding private communications.

Will Cathcart, the head of WhatsApp, called the judgment a “major win for privacy” in a statement on X (formerly Twitter). 

Meanwhile, NSO Group declined to comment on the ruling, though it has previously argued that its technology is designed to support government agencies in fighting crime and terrorism.

The case will now proceed to trial in March 2025, where a jury will determine the financial damages NSO Group must pay.