WhatsApp recently detected and repelled spear-phishing attempts by spyware company NSO Group. The platform is asking the court to hold NSO in contempt for violating a previous injunction.
WhatsApp already achieved a historic victory last year against NSO Group, a spyware company on the US blacklist. The court ruled then that NSO had violated US laws and permanently banned the company from targeting WhatsApp and its users. It now appears that NSO is ignoring those rules.
Therefore, WhatsApp is asking the court to find NSO in default. The platform recently discovered and blocked attempts by NSO to deceive users through social engineering.
NSO Group remains active despite ban
WhatsApp investigated user reports and discovered that NSO was attempting to lure people to external, malicious websites via fake links. This resembles previous 1-click phishing campaigns already linked to NSO. Additionally, NSO created test accounts and groups on WhatsApp, which the platform removed immediately.
The company is now sharing threat indicators so that users and other platforms can check if they have been targeted by these attacks. According to WhatsApp, NSO continues to actively seek new ways to infect devices, not only through WhatsApp but also via browsers, operating systems, and other applications.
Collaboration and support for digital rights
WhatsApp emphasizes that no single company can fight spyware alone. Upon discovering the attack in 2019, WhatsApp collaborated with Citizen Lab to notify victims. Recently, twelve human rights organizations joined the fight against NSO’s appeal of the ban.
WhatsApp is now donating a significant amount to the Spyware Accountability Initiative, which supports organizations worldwide that perform forensic research, user support, and advocacy in the field of spyware. Users remain protected by default end-to-end encryption, but WhatsApp recommends keeping apps and devices up to date.