WhatsApp Wins Pegasus Spyware Case Against NSO Group

WhatsApp and parent company Meta won a major legal victory against NSO Group over the use of Pegasus spyware to hack roughly 1,400 users through a WhatsApp audio-calling vulnerability. The case, filed in 2019, survived NSO’s attempts to dismiss it, including arguments that it should share sovereign immunity with its government customers, and the U.S. Supreme Court later allowed the suit to proceed. A court subsequently found NSO liable for violating the Computer Fraud and Abuse Act, California anti-hacking law, and WhatsApp’s terms of service, and a jury later awarded WhatsApp more than $167 million in damages.

Court proceedings and later reporting exposed new details about the spyware operation and NSO’s conduct during discovery. Trial evidence described a zero-click Pegasus delivery chain using a fake WhatsApp call and infrastructure designed to infect targets using only a phone number, and testimony indicated NSO continued developing WhatsApp-based vectors after the lawsuit began under codenames including Eden, Heaven, Erised, and Hummingbird. Separate reporting alleged NSO sought Israeli government help to keep Pegasus source code and malware documents out of U.S. court, leading to a secret seizure of internal files, while disclosures in the case identified customers including Mexico, Saudi Arabia, and Uzbekistan and reinforced longstanding allegations that Pegasus had been used against journalists, activists, and other civil society targets.