Key Revelations from the WhatsApp vs. NSO Group Spyware Lawsuit

On May 6, 2025, WhatsApp achieved a significant legal victory over NSO Group, with a jury ordering the spyware maker to pay over $167 million in damages. The lawsuit, which began in 2019, centered on NSO Group’s hacking of more than 1,400 WhatsApp users via a zero-click exploit in the app’s audio-calling feature. Court proceedings revealed that NSO continued targeting WhatsApp users even after the lawsuit was filed, using variants of its Pegasus spyware, collectively known as ‘Hummingbird.’ Notably, NSO admitted to targeting a U.S. phone number as a demonstration for the FBI, despite claims that Pegasus cannot be used against American numbers. The trial also disclosed that NSO’s government clients, including Mexico, Saudi Arabia, and Uzbekistan, paid millions for access to Pegasus, with European customers charged around $7 million and additional fees for advanced ‘covert vectors.’ NSO’s CEO revealed operational details, such as the company sharing a building with Apple in Israel and employing between 350 and 380 people. Financial records showed NSO is in a precarious state, reporting multi-million dollar losses and high monthly expenses. The case has shed light on the inner workings, pricing, and global reach of commercial spyware, as well as the ongoing challenges in regulating its use.