Meta has filed a contempt-of-court petition in federal court against NSO Group. The Israeli maker of the Pegasus spyware would have violated the permanent injunction obtained last year, which barred it from targeting WhatsApp and its users.
WhatsApp identified new attack attempts linked to NSO following user reports.
These attempts aimed to push targets to click on malicious links that would redirect them to external sites. The method resembles the “1-click phishing” campaigns previously attributed to NSO. A single click on the link is enough to compromise the device or the victim’s account, without the user having to enter any credentials.
WhatsApp also identified and removed test accounts and test groups created by NSO on its platform.
Meta published the malicious domains used (1) in these attempts so that anyone can verify whether they were targeted, regardless of platform.
Phishing Attempts Detected and Neutralized
In 2025, an American court ordered NSO Group to pay Meta $4 million, a substantial reduction from the $167 million originally sought, and issued a permanent injunction prohibiting it from targeting WhatsApp.
NSO had warned that this decision could end its operations. The company has since appealed the injunction. In May, twelve civil rights organizations, alongside security researchers and digital rights experts, filed amicus briefs in support of Meta in the appellate proceeding.
The CEO of NSO himself confirmed in testimony that the company is seeking “access vectors” to phones beyond WhatsApp, targeting browsers, operating systems and other applications. The targets identified by researchers include journalists, government officials, military personnel and humanitarian organizations.
For Meta, the NSO file illustrates the limits of a defensive approach. It announces funding for the Spyware Accountability Initiative, a fund that supports dozens of organizations specializing in forensic research, victim assistance and advocacy against spyware.
(1) : hxxps://ikhwancast[.]com / hxxps://ghazacast[.]com / hxxps://fr24cast[.]com
