Meta Accuses NSO Group of Violating WhatsApp Injunction With Fresh Spear-Phishing Campaign

Meta caught NSO Group running spear-phishing attempts against WhatsApp users after a permanent court injunction had already ordered the Israeli spyware vendor to stay away from the platform entirely.

What Happened

The campaign followed a straightforward social-engineering pattern. Operators sent messages designed to persuade targets into tapping malicious links. Those links pulled users off WhatsApp and onto attacker-controlled external pages. No publicly documented zero-click exploit chain was involved this time — just a crafted lure, a tap, and a waiting site built to harvest credentials or deliver a payload.

The timing makes the campaign notable. In May 2025, a federal jury handed Meta a civil verdict against NSO Group, awarding approximately $168 million in damages connected to the 2019 Pegasus operation. That earlier campaign had exploited a buffer-overflow vulnerability in WhatsApp's voice-call handler to silently deliver spyware to journalists, human-rights workers, and diplomats — no interaction required. The permanent injunction that accompanied the jury verdict was explicit: NSO is barred from accessing or targeting WhatsApp users or infrastructure in any form.

Meta's contempt filing argues NSO violated that order anyway.

Why a Contempt Motion Is the More Significant Story

Civil damages can be appealed for years. They can be restructured in bankruptcy, absorbed by state-affiliated clients, or simply ignored by a foreign entity with no U.S. assets. Contempt is a different instrument. A contempt finding can place individual officers personally on the hook and gives the presiding court a mechanism to escalate enforcement in ways a standard damages award does not.

NSO has long maintained that it sells Pegasus exclusively to vetted government clients and bears no responsibility for how those governments choose to deploy the tool. That argument may get harder to make when fresh evidence of spear-phishing sits in front of a judge who already signed an injunction forbidding the precise behavior at issue.

As of the time of writing, the court had not ruled on the contempt motion and NSO had not issued a public response to the allegation.

The Phishing-Resistant Auth Gap

The choice of spear-phishing as a tactic tells defenders something important. When zero-click exploit chains get patched or exposed, even well-resourced offensive vendors fall back to clicking links on phones. That is a meaningful capability downgrade — and it is one defenders can actually address.

Against a credential-harvest page on a domain a target trusted enough to visit, standard one-time passcodes or SMS two-factor authentication offer limited protection. An adversary proxying the session can relay stolen tokens in real time, rendering TOTP largely ineffective. Phishing-resistant authentication — FIDO2 passkeys, WebAuthn hardware tokens — removes the replayable credential from the equation entirely. NIST's Digital Identity Guidelines (SP 800-63B) classify FIDO2 authenticators at the highest assurance level precisely because they bind the credential to the legitimate origin, making a lookalike page functionally useless.

The Verizon 2024 Data Breach Investigations Report found that phishing was the initial access vector in 15 percent of all breaches analyzed, with credential theft the dominant outcome. Against nation-state-adjacent operators like NSO's government clients, that figure likely understates actual exposure for high-value targets.

Who Is Actually at Risk

NSO's known customer base has historically targeted a specific population: journalists, political dissidents, opposition figures, lawyers representing sensitive clients, NGO workers, and senior executives at organizations governments want to monitor. If you work with or support any of those groups, the threat model applies to people around you even if it doesn't apply directly to you.

Practical steps for high-risk users are well-established. Apple's Lockdown Mode, introduced in iOS 16, reduces the attack surface on iPhone by disabling link previews, blocking most message attachment types, and limiting certain network connections. Android offers equivalent hardened profiles through enterprise device management policies. Pair either configuration with hardware-backed passkeys on every account that matters.

Treat unsolicited WhatsApp messages from unknown contacts with the same skepticism you would apply to an unexpected email from a stranger. The delivery channel changed. The social engineering didn't.

What the Control Failure Actually Was

This incident illustrates two separate failures that security teams should examine independently.

The first is the limit of legal deterrence as a security control. A permanent injunction is a powerful legal instrument, but it is not a technical barrier. It does not prevent a foreign vendor from continuing to operate against targets outside U.S. jurisdiction, and it does not automatically alert defenders when that operation begins. Organizations protecting high-risk individuals cannot treat a court order as a substitute for endpoint hardening and authentication hygiene.

The second failure is the enduring effectiveness of human-targeted deception at the highest levels of offensive capability. Employees and high-profile individuals who understand how to recognize a malicious link before tapping it represent a genuine reduction in attack surface — not a complete defense, but a meaningful one. Organizations that train staff to scrutinize unexpected links, verify sender identity through a separate channel, and report suspicious messages before clicking create friction that slows even well-funded operators. Security-awareness training that uses realistic simulated phishing scenarios, not just annual compliance videos, measurably reduces click rates on exactly the type of lure NSO's operators deployed here. Train2Secure's simulation-based training programs are built around that evidence — you can review the methodology and standards behind the curriculum before committing to anything.

What Defenders Should Do Now

Four actions are worth prioritizing immediately for any organization that includes high-risk individuals in its user population:

• Audit authentication methods across all critical accounts. Replace SMS and TOTP with FIDO2 passkeys or hardware security keys wherever possible.
• Enable Lockdown Mode on iOS devices issued to journalists, executives, legal staff, and anyone else whose communications a government might want to monitor.
• Run phishing simulations that include mobile messaging vectors — most awareness programs still focus on email. WhatsApp, Signal, and SMS lures require separate training scenarios.
• Establish a clear reporting path for suspicious messages. Users who know where to send a suspicious link without fear of blame are more likely to report before they click.
• Inventory your high-risk user population explicitly. If your organization employs or supports people NSO's known clients have historically targeted, those users need a differentiated security profile, not just the standard employee baseline.

The court filing is pending. The underlying threat is not.