WhatsApp Claims NSO Group-Linked Entity Unsuccessfully Carried Out Fresh Phishing Attacks Against Users

Meta has successfully disrupted phishing attacks against WhatsApp users after investigating various reports, the Mark Zuckerberg-led tech giant revealed on Monday. The company claims that the attack was orchestrated by an entity linked to the NSO Group, which is known for creating and selling its Pegasus surveillance software to governments. Meta claims that, with this new wave of attacks, the NSO Group stands in violation of a 2025 court order, barring it from further targeting WhatsApp users. While the company claims to have successfully thwarted the attacks, it now plans to hold the spyware firm in contempt of the US District Court's order.

Meta to Approach US District Court to Hold the NSO Group in Contempt

In a blog post, the US-based tech giant claimed that it managed to thwart a fresh wave of “spear phishing” attacks against WhatsApp users. The company alleges that the “social engineering attempts” were carried out by an entity linked to Israel's NSO Group, a spyware firm. WhatsApp says it was alerted to these attacks after various user reports.

The tech giant also claimed that the NSO Group-linked attackers tried to dupe WhatsApp users by tricking them into clicking on malicious links, which would redirect them to an external website. Meta claims that this appears to be similar to the “previously reported 1-click phishing campaigns” that have been orchestrated by the Israeli spyware firm.

Meta claims that it also caught the bad actors creating test accounts and groups on WhatsApp, which the tech giant has since taken down. The company has also revealed three malicious domains as part of the threat indicators to alert WhatsApp users, allowing them to check whether they were targeted by the NSO Group-linked phishing attacks across platforms via text messages, emails, or WhatsApp messages.

The company now plans to approach the US District Court that granted the tech company an injunction in 2025, which barred the Israel-based surveillance-for-hire firm from attacking WhatsApp users in the future. The company says that it will request the judicial body to hold the NSO Group in contempt of its order.

In 2024, a US District Court first ruled in favour of Meta, finding the NSO Group in violation of the federal Computer Fraud and Abuse Act (CFAA) and the State of California's Comprehensive Computer Data Access and Fraud Act (CDAFA). In 2025, a separate hearing was held to ascertain the compensation, during which the Court granted the injunction.