WhatsApp has disrupted a new spyware campaign linked to the NSO Group, the controversial surveillance vendor behind Pegasus, while simultaneously seeking legal action against the company for allegedly violating a U.S. court injunction.
The disclosure highlights NSO’s continued efforts to target users despite a landmark 2025 ruling that permanently barred the firm from accessing WhatsApp’s platform.
According to WhatsApp, the latest activity involved spear-phishing operations designed to deliver Pegasus spyware via one-click exploitation.
Attackers attempted to lure targets into clicking malicious links that redirected victims to external domains, a tactic consistent with previously documented Pegasus delivery mechanisms.
The campaign was uncovered following user reports, prompting an internal investigation that led to the identification and takedown of attacker-controlled infrastructure, including WhatsApp test accounts and malicious groups used to facilitate targeting.
The company stated that the activity directly violates a permanent injunction issued after courts found NSO Group liable for breaching U.S. federal and state anti-hacking laws.
WhatsApp has now petitioned the court to hold NSO in contempt, signaling an escalation in legal enforcement as the spyware vendor allegedly continues operations despite regulatory restrictions and its inclusion on the U.S. Entity List.
Technical analysis suggests that while WhatsApp remains a high-value vector, NSO’s operational model extends beyond a single platform.
Court testimony from NSO executives previously confirmed that the company actively researches multiple “vectors” to compromise devices, including mobile operating systems, web browsers, and third-party applications.
This multi-vector capability aligns with Pegasus’ evolution from zero-click exploits to more socially engineered delivery methods when direct exploitation paths are mitigated.
WhatsApp also released indicators of compromise (IOCs) associated with the campaign to support cross-platform detection and threat hunting. Identified malicious domains include:
These domains were reportedly used in phishing lures to initiate infection chains outside the WhatsApp environment, reinforcing the need for defenders to monitor activity beyond a single application layer.
The broader implications of the campaign underscore ongoing concerns around the commercial spyware industry.
WhatsApp emphasized that surveillance-for-hire vendors continue to target a wide range of individuals, including journalists, government officials, and civil society actors. The company reiterated that such tools represent a national security threat, particularly when deployed in violation of legal frameworks.
In parallel with enforcement actions, WhatsApp announced financial support for the Spyware Accountability Initiative (SAI), a coalition focused on forensic research, victim assistance, and advocacy against unlawful surveillance.
The initiative builds on prior collaborations with organizations such as Citizen Lab, which have played a critical role in uncovering zero-day vulnerabilities and attributing spyware campaigns.
Despite the threat activity, WhatsApp confirmed that its end-to-end encryption remains intact, ensuring that message content cannot be intercepted directly.
However, the company warned that endpoint compromise via spyware like Pegasus bypasses encryption protections entirely, making user vigilance and device security updates essential.
The incident highlights a persistent reality in modern threat landscapes: even as legal and technical barriers increase, advanced spyware operators continue to adapt their tactics, shifting toward social engineering and multi-platform exploitation to maintain access to high-value targets.
Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.
Attackers abused compromised ConnectWise Cloud Backup credentials to access Microsoft 365 customer environments, prompting ConnectWise…
Anthropic says an internal Claude research model reconstructed how the National Security Agency generated seeds…
Two WordPress Core vulnerabilities can be chained to execute remote code without authentication, according to…
A newly disclosed OpenBSD kernel exploitation chain combines a shared memory accounting flaw with a…
GhostAction attackers have expanded their GitHub credential theft campaign with a second stage that disguises…
Indian authorities have warned that SideCopy hackers are targeting Indian organizations, including academic institutions, with…