Key Highlights
- WhatsApp’s parent company Meta has initiated federal contempt proceedings against NSO Group for purportedly breaking a court-imposed permanent injunction.
- The social media giant identified and blocked fresh spear-phishing operations connected to NSO that attempted to direct users toward harmful websites.
- The Israeli spyware developer faces a U.S. government blacklist due to national security threats and foreign policy complications.
- Federal judges previously mandated NSO cease all operations targeting WhatsApp’s platform, with NSO stating the decision could end its operations.
- Meta reports removing trial accounts and chat groups established by NSO on WhatsApp, while receiving backing from a dozen civil liberties groups challenging NSO’s appeal.
WhatsApp’s parent company Meta initiated contempt proceedings in federal court this Monday, charging Israeli spyware developer NSO Group with breaking a permanent court order that prohibited targeting WhatsApp’s platform and user base.
Shares of META were hovering near $692 Monday when the announcement emerged.
This action intensifies an ongoing legal confrontation that previously delivered a significant courtroom victory for the tech giant. Last year, a U.S. judge mandated NSO compensate $4 million in damages — dramatically reduced from the original $167 million award — while imposing a lifetime prohibition on targeting WhatsApp’s services.
Yet according to Meta, NSO allegedly continued its activities despite the prohibition.
WhatsApp’s security teams uncovered fresh “spear phishing” operations attributed to NSO during recent weeks. These sophisticated attacks sought to manipulate targets into activating malicious URLs that rerouted them to dangerous external domains — what Meta characterizes as “1-click phishing” tactics, where merely clicking a link can infiltrate a device or account without requiring credential input.
According to Meta’s statement, WhatsApp discovered and eliminated test profiles and discussion groups that NSO allegedly established within the platform. The spyware firm declined to provide commentary on the allegations.
Anatomy of the Phishing Operations
The discovered attacks resembled techniques NSO deployed in earlier operations. Targets received malicious URLs designed for maximum efficiency; a single click posed sufficient risk to deploy surveillance technology without requiring passwords or authentication steps.
NSO’s primary offering, the Pegasus spyware system, remains central to these allegations. Meta and WhatsApp have previously charged NSO with exploiting a WhatsApp security weakness to deploy Pegasus across more than 1,400 devices worldwide. Those reportedly affected included media professionals, public sector officials, and humanitarian organization personnel.
U.S. authorities have placed NSO Group on an official blacklist, referencing operations that conflict with American national security objectives and diplomatic interests. NSO has previously stated that the permanent injunction could effectively terminate its business operations.
Civil Rights Organizations Rally Behind Meta
Last month, a coalition of twelve civil liberties organizations joined Meta’s opposition to NSO’s appeal of the court injunction. This alliance comprises cybersecurity researchers, privacy protection advocates, and digital freedom specialists who submitted supporting legal briefs endorsing Meta’s stance.
Meta has characterized commercial spyware as representing a “national security threat” while emphasizing that individual corporations cannot successfully counter surveillance-for-hire operations without broader support.
This contempt motion represents Meta’s most recent effort to uphold the judicial order and prevent NSO from accessing its platforms. Federal courts will now review the case once again.


