WhatsApp Accuses NSO Group of Violating Court Injunction Through New Spyware-Linked Phishing Campaign

WhatsApp, owned by Meta, has accused Israeli spyware developer NSO Group of violating a permanent court injunction that prohibits the company from targeting WhatsApp users. According to WhatsApp, it recently identified and disrupted a spear-phishing campaign that was linked to NSO Group and appeared to resemble previous one-click phishing operations associated with the spyware vendor. The company stated that the attackers attempted to deceive users into clicking malicious links and also created test accounts and groups on the platform as part of the operation.

The dispute follows a long-running legal battle between WhatsApp and NSO. In 2019, WhatsApp sued the spyware company after a zero-day vulnerability was allegedly exploited to deploy surveillance software against users. The case resulted in a December 2024 ruling finding NSO liable, followed by a 2025 jury decision ordering the company to pay significant damages. Although punitive damages were later reduced, the court granted WhatsApp a permanent injunction barring NSO from targeting its platform and users.

WhatsApp now claims that the newly detected activity demonstrates a breach of that injunction and has announced plans to seek a federal court contempt order against NSO. The company says it has already disabled the accounts and groups involved in the operation and shared several domains as indicators of compromise.

The development comes as civil society organizations continue to support legal restrictions on NSO’s activities. WhatsApp also announced a substantial contribution to the Spyware Accountability Initiative, a fund dedicated to investigating, exposing, and combating the misuse of commercial spyware technologies. The case highlights ongoing concerns about the use of surveillance tools by private spyware vendors and the challenges of enforcing legal restrictions against them.