Meta Seeks Contempt Order Over NSO-Linked WhatsApp Phishing Campaign

Meta said it disrupted a new NSO Group-linked operation that used one-click phishing against WhatsApp users and has asked a U.S. federal court to hold the spyware vendor in contempt for allegedly violating a permanent injunction. According to WhatsApp, the activity relied on malicious external links, social engineering, and WhatsApp test accounts and groups used to stage the attacks, echoing tactics previously associated with Pegasus spyware campaigns. Meta also published malicious domains and related indicators tied to the infrastructure and said it removed the accounts involved.

The alleged targeting primarily affected fewer than 10 users in Jordan and Lebanon, and WhatsApp said it found no evidence of successful device compromise. The filing follows earlier court action over NSO’s 2019 campaign that exploited a WhatsApp VOIP stack buffer overflow to compromise about 1,400 users, a case that resulted in a jury award of more than $167 million in punitive damages plus compensatory damages and a court order barring NSO from targeting WhatsApp or its users. Meta said the new activity shows continued exploit development and spyware operations despite that injunction.