Redazione RHC:23 October 2025 16:47
A federal court has ordered Israeli company NSO Group (developer of the commercial spyware Pegasus) to stop using spyware to target and attack WhatsApp users.
Please note that Pegasus is a spyware platform developed by NSO Group. Pegasus is sold as legitimate spyware and used for espionage and surveillance activities worldwide. Pegasus (and, through it, NSO Group’s customers) can collect text messages and app information from iOS and Android devices, intercept calls, track locations, steal passwords, and more.
In 2019, WhatsApp representatives filed a lawsuit against NSO Group, accusing the company of aiding and abetting cyberattacks conducted on behalf of various governments in 20 countries, including Mexico, the United Arab Emirates, and Bahrain. The lawsuit sought monetary damages and an injunction against such practices.
This litigation continues to this day. For example, in late 2024, unredacted court documents became public. According to these documents, until approximately April 2018, NSO Group used a custom WhatsApp client (WhatsApp Installation Server, or WIS) and a proprietary exploit called Heaven for attacks. This exploit could impersonate the official WhatsApp client and was used to install Pegasus on victims’ devices from a third-party server controlled by NSO.
After WhatsApp developers discovered the issue and blocked NSO Group’s access to infected devices and servers with patches released in September and December 2018, the Heaven exploit stopped working.
Then, in February 2019, NSO Group created a new exploit, Eden , to bypass WhatsApp’s new security measures. In May 2019, WhatsApp officials discovered that Eden had been used by NSO Group customers to attack approximately 1,400 devices, many of which belonged to lawyers, journalists, human rights activists, political dissidents, diplomats, and senior foreign officials.
Last week, Judge Phyllis J. Hamilton of the United States District Court for the Northern District of California granted a request for a permanent injunction filed by WhatsApp owner Meta against NSO Group in 2019.
The court’s decision requires NSO Group to permanently stop targeting WhatsApp users by attempting to infect their devices or intercept WhatsApp messages, which are protected by end-to-end encryption via the open-source Signal protocol. Hamilton also ordered NSO Group to delete all data previously obtained by targeting WhatsApp users.
NSO Group representatives had previously stated that such a decision would “force the company to shut down” because Pegasus was its flagship product. However, Hamilton felt that the damage Pegasus would cause to Meta outweighed such considerations.
“The court finds that any company that handles users’ personal information and invests resources in encrypting that information suffers unauthorized access, and this is not just reputational harm, but business harm,” Hamilton said. “Essentially, companies like WhatsApp sell, among other things, information privacy, and any unauthorized access undermines that sale. The defendants’ actions defeat one of the primary purposes of the plaintiffs’ service, which constitutes direct harm.”
The judge also denied Meta’s request to extend the injunction to foreign governments that may be using WhatsApp, noting that sovereign states are not parties to the case. Meta’s request to extend the injunction to targeted attacks on users of other Meta products (such as Facebook and Instagram) was also denied, citing the lack of evidence of targeted attacks.
“Today’s ruling prevents spyware developer NSO Group from again targeting WhatsApp and our users around the world ,” said WhatsApp CEO Will Cathcart. “We welcome this decision, which comes after six years of legal action to hold NSO Group accountable for its attacks on civil society. It sets an important precedent: targeting a US company carries serious consequences.”
Hamilton also reduced the punitive damages awarded by the jury to NSO Group in May 2025. The jury’s original verdict required NSO Group to pay WhatsApp $167 million, but that amount has now been reduced to $4 million. The judge noted that the jury’s previous criteria for determining the amount of the penalty were flawed.
NSO Group representatives told the media that the company welcomed the court’s decision to reduce the punitive damages by 97%, “compared to the excessive amount” initially determined by the jury.
Redazione
The editorial team of Red Hot Cyber consists of a group of individuals and anonymous sources who actively collaborate to provide early information and news on cybersecurity and computing in general.