Israeli spyware firm NSO Group targeted WhatsApp users despite US court order

Meta has reported that the Israeli spyware firm NSO Group targeted WhatsApp users in Jordan and Lebanon with malicious links, despite a prior US court order prohibiting such actions. The tech giant stated that it detected and disrupted these "spear phishing attempts" and observed NSO Group creating "test accounts and groups" on the platform.

WhatsApp identified the one-click infection domains used by NSO Group as "ikhwancast", "ghazacast", and "fr24cast." John Scott-Railton of Citizen Lab raised questions about whether "fr24cast" was an attempt to impersonate the media outlet France24.

NSO Group, known for its Pegasus spyware, has a history of infiltrating WhatsApp users to harvest data. The company lost a court case against Meta in 2025 and was ordered to pay $167 million in damages, though this was later reduced to $4 million. Crucially, NSO Group was permanently barred from targeting WhatsApp and its users.

Meta asserts that these recent breaches demonstrate NSO Group's violation of the court order. The company has been on a US blacklist since the Biden administration determined its activities were contrary to US foreign policy and national security interests, preventing it from conducting business with US companies without specific approval.

Reports indicate that NSO Group is currently seeking to be removed from this blacklist under the Trump administration. David Friedman, who served as the US ambassador to Israel during Trump's first term, was appointed as NSO Group's executive chair last year.

In 2021, investigations revealed that Pegasus spyware was allegedly used by governments, including Saudi Arabia, Morocco, Bahrain, and the UAE, to spy on activists, journalists, and political dissidents.