WhatsApp steps up fight against NSO-linked phishing, seeks contempt order

WhatsApp, the encrypted messaging service owned by Meta, said it has disrupted a fresh campaign it links to NSO Group, a spyware vendor that the U.S. government has blacklisted. In a new update posted to Meta’s newsroom on June 8, WhatsApp said investigators identified spear-phishing attempts aimed at tricking people into clicking malicious links that would move victims off WhatsApp and onto external websites.

The company said the activity surfaced after it reviewed user reports. WhatsApp described the attempt as social engineering designed to push targets toward “malicious links” and said the approach resembled other NSO-linked 1-click phishing campaigns that have been reported in the past. Meta also said it found and dismantled NSO-linked test accounts and groups created on WhatsApp during the effort.

WhatsApp said it is asking a court to hold NSO Group in contempt of a permanent injunction that barred the company from targeting WhatsApp and its users. The post framed the legal filing as part of a continuing fight after a landmark verdict and injunction last year, adding that the court found NSO had violated laws against hacking.

In addition to describing the disruption, WhatsApp said it published threat indicators so people can check whether they were targeted by NSO-linked social engineering attempts across platforms, including text messaging, email, and WhatsApp messages. The post also included examples of malicious domains used in the campaign, underscoring that the tactic relied on lures and links rather than a claimed compromise of WhatsApp’s end-to-end encrypted message layer.

The update also reiterated WhatsApp’s broader position that spyware is a national security threat. WhatsApp said NSO’s CEO confirmed in court that the company looks for “vectors,” meaning routes to access a phone, beyond WhatsApp itself, including through browsers, operating systems, and other applications. WhatsApp said it supports wider efforts involving privacy advocates and security researchers that track spyware development and hold vendors accountable.

Meta’s newsroom post emphasized that WhatsApp messages and calls remain protected by default end-to-end encryption, and it urged users to keep apps and devices up to date, report suspicious activity, and enable stricter account settings. The company did not specify how many users were targeted in this latest disruption, nor did it provide technical details about any vulnerability chain, device impact, or whether victims were able to reach external landing pages.

For context, this dispute has played out in court for years, with Meta and WhatsApp positioning NSO as an illegal surveillance-for-hire supplier. What remains unclear from the June 8 update is the full scope of the campaign, including geography beyond the company’s general framing, the number of accounts affected, and whether NSO has responded to Meta’s contempt request in filings or public statements. Meta also did not describe whether the campaign used any new exploit technique or whether it relied primarily on phishing infrastructure and engineered accounts.

Going forward, investors and policy watchers will likely focus on any court action that follows WhatsApp’s contempt filing, including whether the court cites additional violations and what remedies are ordered. Meta may also face continued scrutiny over spyware risks in the broader ecosystem of messaging and mobile applications, even as it highlights encryption as a core safety feature.