WhatsApp tells a federal court it thwarted renewed NSO-linked phishing attempts, while pressing for contempt

WhatsApp said it has caught and disrupted renewed spyware-adjacent targeting linked to NSO Group, and it is asking the court to hold NSO in contempt of an order meant to prevent future attacks on WhatsApp users. In a post dated June 8, 2026, Meta framed the latest effort as part of an ongoing legal and security fight after a prior case led to a landmark verdict and a permanent injunction barring NSO from targeting WhatsApp and its users.

WhatsApp’s complaint with the court is tied to what Meta described as social engineering attempts that relied on tricking people into clicking malicious links that would route them to external websites outside WhatsApp. Meta said it reached that assessment after investigating user reports, and it compared the approach to earlier “1-click phishing” campaigns previously attributed to NSO-linked activity. In addition to the link-based tactics, WhatsApp said NSO-linked actors created test accounts and groups inside WhatsApp, which WhatsApp then took down.

The post also said WhatsApp is sharing threat indicators so people can check whether they were targeted by NSO-linked social engineering attempts across channels, including text messages, email, and WhatsApp messages. Meta included examples of malicious domains it said were used in those attempts, listing obfuscated versions of ikhwancast[.]com, ghazacast[.]com, and fr24cast[.]com.

Meta’s broader contention is that spyware vendors do not stop developing capabilities just because communications platforms win court orders. The company cited its case history since 2019 and pointed to NSO’s own testimony in court that it looks for “vectors, or ways to access the phone” beyond WhatsApp, including through browsers, operating systems, and other applications. Meta argued that, because those pathways are wider than one messaging service, restrictions must remain in place.

In the post, Meta described spyware as a national security threat and highlighted the range of reported targets for surveillance-for-hire firms, including journalists, government officials, military personnel, and humanitarian organizations. The company said the U.S. government’s Entity List restrictions and the court’s permanent injunction should not be loosened, arguing that doing so would undermine national security and increase risk for companies and billions of people that depend on secure communications.

Meta connected the legal fight to an industry-wide effort, saying it worked with Citizen Lab after first discovering the 2019 attack and notifying targets, and that other organizations supported the case when it went to trial. It also said it was joined last month by 12 civil rights organizations that filed amicus briefs in opposition to NSO’s appeal of the permanent injunction, describing the coalition as a mix of security researchers, privacy advocates, and digital rights experts.

Separately, Meta said it is making a contribution to the Spyware Accountability Initiative (SAI), a fund intended to support civil society groups that expose and challenge spyware abuse. SAI’s description emphasizes grants for work spanning digital forensics, legal advocacy, user support, and research into spyware harms, and it says it has awarded grants since 2023 to multiple organizations across regions. Meta positioned the payment as part of its promise to help strengthen digital rights work that confronts spyware attacks.

Meta pointed to examples that it said illustrate how civil society efforts can lead to security outcomes, including a Citizen Lab zero-day discovery that prompted an Apple security update for more than a billion devices, and a Greek court case that it said resulted in criminal convictions of spyware executives based on forensic and investigative reporting. The post characterized the work as demanding, sometimes dangerous, and frequently under-resourced compared with the spyware industry’s ongoing development of new exploits.

Meta did not provide additional quantitative details in its June 8 update, such as how many accounts were targeted or the exact technical chain of events behind the links. It also did not specify what, if any, new legal filings have been submitted beyond the contempt request, beyond describing the step it is taking with the court. What to watch next is whether the court responds to the contempt request and whether WhatsApp issues further indicator updates if new domains or tactics appear, especially as NSO-linked social engineering attempts appear to be shifting toward tactics that drive targets outside WhatsApp before any compromise attempt occurs.