Meta-owned communications app WhatsApp says it recently detected and disrupted a spear-phishing attempt linked to spyware company NSO Group. The attack is allegedly in defiance of a court order that bars the spyware maker from targeting WhatsApp.
WhatsApp filed a lawsuit against NSO in 2019, after it came to light that a zero-day vulnerability had been exploited to deliver spyware to users.
In December 2024, a judge ruled that NSO is liable, and in May 2025 a jury ordered the spyware maker to pay more than $444,000 in compensatory damages and $167 million in punitive damages, which NSO appealed.
In October 2025, a judge reduced the punitive damages to $4 million, but WhatsApp was granted a permanent injunction barring NSO from hacking its users.
NSO has been seeking to overturn the order blocking it from targeting WhatsApp users, arguing that the company will “suffer irreparable harm”.
