WhatsApp Blocks New NSO Group Spyware Campaign, Files Court Motion
WhatsApp disrupted a new spyware campaign linked to NSO Group, violating court orders.
Why it matters: WhatsApp's revelation highlights the persistent cybersecurity threats spyware firms pose to platforms used by legal professionals and privacy advocates. It intensifies scrutiny of surveillance tech vendors affecting legal tech security and client confidentiality.
- On June 8, 2026, WhatsApp announced it blocked spear-phishing attacks linked to NSO Group.
- WhatsApp is filing a federal court contempt order against NSO for breaching a permanent injunction preventing targeting of its users.
- The recent attacks used malicious links to external sites, similar to NSO's prior "1-click" phishing tactics.
- WhatsApp identified and removed NSO-created test accounts and groups on its platform.
On June 8, 2026, WhatsApp revealed it had disrupted a new spyware attack campaign linked to the Israeli NSO Group. NSO, already blacklisted by the U.S. government for threats to national security and foreign policy, had been previously barred by a court injunction from targeting WhatsApp users.
Despite the injunction, WhatsApp is now filing a contempt order against NSO, emphasizing its violation of the permanent court order. The attack involved sophisticated spear-phishing tactics, where users were tricked into clicking malicious links directing them to external websites, echoing NSO’s prior "1-click" phishing approach.
WhatsApp also uncovered NSO’s creation of test accounts and groups on its platform to facilitate these attacks, which were promptly taken down. NSO’s ongoing cyber operations are not new; in 2019, it targeted over 1,400 WhatsApp users, resulting in a $167 million jury award against the spyware firm in 2025, later reduced to about $4 million after appeals (TechCrunch).
This latest disclosure underscores continued cybersecurity risks, particularly for legal professionals who rely on platforms like WhatsApp for confidential communication. It also highlights persistent challenges in enforcing court orders against sophisticated spyware vendors whose technology can undermine digital privacy.
By the numbers:
- June 8, 2026 — Date WhatsApp announced disrupting NSO-linked spyware attacks
- Over 1,400 — WhatsApp users targeted in NSO’s 2019 hacking campaign
- $167 million — Original damages awarded against NSO Group in 2025
What's next: WhatsApp's newly filed federal court contempt motion could escalate legal restrictions on NSO Group's access to digital communications platforms.