The US government has blacklisted NSO Group for actions contrary to national security, but the spyware firm continued to target WhatsApp users in direct violation of the order. WhatsApp has detected and disrupted these attempts. WhatsApp is now asking the court to hold NSO in contempt.
| Key Points | Details |
|---|---|
| Story about: | NSO Group Spyware |
| What happened: | WhatsApp caught NSO Group violating a permanent injunction and is asking the court to hold them in contempt. |
| Previous news: | WhatsApp drops support for older iOS versions in November 2026 |
WhatsApp secured a landmark verdict against NSO Group
Last year, WhatsApp made history by winning a landmark court case against NSO Group, a spyware firm that the US government has blacklisted for actions contrary to national security. The court issued a permanent injunction that prohibits NSO from ever targeting WhatsApp and its users again. Since NSO violated several federal and state laws against hacking, the court ruled against NSO. This legal victory is important not just for WhatsApp, but for digital rights and privacy advocates worldwide.
NSO Group violated the court order
Despite the permanent injunction, NSO Group did not stop. WhatsApp successfully detected and disrupted attempts linked to NSO. The attacks involved attempts to trick people into opening malicious links that redirected to external websites outside of WhatsApp. This tactic matches one-click phishing campaigns linked to NSO that have been documented before. WhatsApp also identified some test accounts and groups created by NSO on the platform, all of which were taken down. As a result, WhatsApp is now asking the court to take action against NSO for violating the injunction.
WhatsApp is sharing threat indicators publicly
As part of its commitment to transparency, WhatsApp is sharing threat indicators linked to these engineering attempts. Anyone can use these indicators to check whether they were targeted on any platform. This means that the issue doesn't only impact WhatsApp, but even text messages, emails, or other channels. This information makes it harder for spyware operators to act undetected.
Spyware is a national security threat
WhatsApp has been clear on this point since 2019: spyware is not just a privacy issue, it is a national security threat. In court, NSO's own CEO confirmed that the company actively looks for new ways to access phones beyond WhatsApp. This extends to browsers, operating systems, and other applications. The reported targets include journalists, government officials, military personnel, and humanitarian organizations. When companies on the US government's Entity List defy court orders, they undermine national security. They also put billions of people who depend on secure communications at risk.
No company can fight spyware alone
WhatsApp has never fought this battle alone. When WhatsApp first discovered NSO's 2019 attack, the Citizen Lab helped notify the people who had been targeted. Some organizations supported the case when it went to trial. Last month, twelve major civil rights organizations asked the court to uphold the permanent injunction and reject NSO's appeal. The fight against spyware is gaining support from more experts and organizations. As a result, WhatsApp is making it difficult for spyware firms like NSO to operate in the shadows.
WhatsApp is funding the fight against spyware
Will Cathcart announced that WhatsApp is making its first donation to the Spyware Accountability Initiative (SAI). SAI is an organization that supports forensic research and advocacy against spyware. A Citizen Lab zero-day discovery led to an Apple security update reaching over a billion devices. This year, a Greek court issued the first-ever criminal conviction of spyware company executives. The contribution from WhatsApp shows that this work is hard, can be risky, and often gets less funding than the spyware companies it fights.
What WhatsApp users should do
WhatsApp reassures users that their personal messages and calls are protected by end-to-end encryption. However, you should take a few precautions. Keep WhatsApp and your device's operating system always up to date. Additionally, you should report any suspicious activity directly within the app, so WhatsApp can investigate and take action. For people who believe they may be targeted by sophisticated cyberattacks, WhatsApp strongly recommends enabling strict account settings to add a new layer of protection to their account.
Connect with WABetaInfo
Follow WABetaInfo on X to learn more about new features and updates. We love hearing your feedback, so please let us know what you think! You can also visit our About page to explore all our services and keep up with the latest announcements.