THE APEX TIMES
WhatsApp tells a federal court it thwarted renewed NSO-linked phishing attempts, while pressing for contempt
Meta said it disrupted social engineering designed to move targets off WhatsApp, and it asked the court to punish NSO Group for violating a permanent injunction that bars the company from targeting WhatsApp users.
WhatsApp said it has caught and disrupted renewed spyware-adjacent targeting linked to NSO Group, and it is asking the court to hold NSO in contempt of an order meant to prevent future attacks on WhatsApp users. In a post dated June 8, 2026, Meta framed the latest effort as part of an ongoing legal and security fight after a prior case led to a landmark verdict and a permanent injunction barring NSO from targeting WhatsApp and its users.
WhatsApp’s complaint with the court is tied to what Meta described as social engineering attempts that relied on tricking people into clicking malicious links that would route them to external websites outside WhatsApp. Meta said it reached that assessment after investigating user reports, and it compared the approach to earlier “1-click phishing” campaigns previously attributed to NSO-linked activity. In addition to the link-based tactics, WhatsApp said NSO-linked actors created test accounts and groups inside WhatsApp, which WhatsApp then took down.
The post also said WhatsApp is sharing threat indicators so people can check whether they were targeted by NSO-linked social engineering attempts across channels, including text messages, email, and WhatsApp messages. Meta included examples of malicious domains it said were used in those attempts, listing obfuscated versions of ikhwancast[.]com, ghazacast[.]com, and fr24cast[.]com.
Meta’s broader contention is that spyware vendors do not stop developing capabilities just because communications platforms win court orders. The company cited its case history since 2019 and pointed to NSO’s own testimony in court that it looks for “vectors, or ways to access the phone” beyond WhatsApp, including through browsers, operating systems, and other applications. Meta argued that, because those pathways are wider than one messaging service, restrictions must remain in place.
In the post, Meta described spyware as a national security threat and highlighted the range of reported targets for surveillance-for-hire firms, including journalists, government officials, military personnel, and humanitarian organizations. The company said the U.S. government’s Entity List restrictions and the court’s permanent injunction should not be loosened, arguing that doing so would undermine national security and increase risk for companies and billions of people that depend on secure communications.
Meta connected the legal fight to an industry-wide effort, saying it worked with Citizen Lab after first discovering the 2019 attack and notifying targets, and that other organizations supported the case when it went to trial. It also said it was joined last month by 12 civil rights organizations that filed amicus briefs in opposition to NSO’s appeal of the permanent injunction, describing the coalition as a mix of security researchers, privacy advocates, and digital rights experts.
Separately, Meta said it is making a contribution to the Spyware Accountability Initiative (SAI), a fund intended to support civil society groups that expose and challenge spyware abuse. SAI’s description emphasizes grants for work spanning digital forensics, legal advocacy, user support, and research into spyware harms, and it says it has awarded grants since 2023 to multiple organizations across regions. Meta positioned the payment as part of its promise to help strengthen digital rights work that confronts spyware attacks.
Meta pointed to examples that it said illustrate how civil society efforts can lead to security outcomes, including a Citizen Lab zero-day discovery that prompted an Apple security update for more than a billion devices, and a Greek court case that it said resulted in criminal convictions of spyware executives based on forensic and investigative reporting. The post characterized the work as demanding, sometimes dangerous, and frequently under-resourced compared with the spyware industry’s ongoing development of new exploits.
Meta did not provide additional quantitative details in its June 8 update, such as how many accounts were targeted or the exact technical chain of events behind the links. It also did not specify what, if any, new legal filings have been submitted beyond the contempt request, beyond describing the step it is taking with the court. What to watch next is whether the court responds to the contempt request and whether WhatsApp issues further indicator updates if new domains or tactics appear, especially as NSO-linked social engineering attempts appear to be shifting toward tactics that drive targets outside WhatsApp before any compromise attempt occurs.
Why It Matters
- A contempt filing indicates that Meta is treating NSO-linked activity as an ongoing breach issue rather than a one-time incident, potentially keeping pressure on NSO while the appeal process continues.
- The episode highlights how spyware targeting does not have to originate inside WhatsApp to be relevant to WhatsApp users, since social engineering can move victims to external sites.
- By publishing threat indicators, Meta is increasing operational transparency for users and researchers, which may improve detection and response across multiple platforms.
- The emphasis on court enforcement and Entity List restrictions suggests that the practical boundary for spyware vendors may be defined as much by legal compliance as by technical defenses.
Sources
Key Facts
- WhatsApp said it disrupted NSO-linked social engineering by investigating user reports about malicious links that moved targets to external websites outside WhatsApp.
- Meta said it also took down NSO-linked test accounts and groups created on WhatsApp.
- Meta said it is asking the court to hold NSO Group in contempt of a permanent injunction barring NSO from targeting WhatsApp and its users.
- WhatsApp said it shared threat indicators that include examples of malicious domains such as ikhwancast[.]com, ghazacast[.]com, and fr24cast[.]com.
- Meta said NSO’s CEO testified that NSO looks for “vectors, or ways to access the phone” beyond WhatsApp, including through browsers and other applications.
- Meta said SAI supports civil society efforts against spyware, and it announced a new contribution to support that ecosystem.
Technology Related
Apple says it has evidence a former employee destroyed material after learning of an investigation
The dispute, reported by Yahoo Finance, centers on claims that an ex-employee allegedly took and used company data tied to OpenAI, and Apple says it has proof related to the alleged cover-up.
Anthropic agrees to a $35 billion cloud computing deal tied to Nvidia-backed Lambda, report says
Anthropic PBC is reportedly moving to lock in large-scale compute capacity through a major multi-year arrangement with Lambda, a cloud provider backed by Nvidia. Terms and timelines were not fully disclosed in the report.
AMD has tended to fall in September, but market history is only part of the story
A review of the past decade points to a recurring pattern for AMD in September. The stock has declined in eight of the last 10 Septembers, though broader market seasonality appears to explain only some of the weakness.
Duolingo shares jump after results point to steady user momentum, according to Yahoo Finance
A Yahoo Finance report highlighted that Duolingo’s second-quarter revenue rose 18% year over year, using the framing of a “Netflix-like comeback” after a period of volatility in the online learning category.
Netflix confirms production of Korean series “Materesa (WT),” led by “Queen of Tears” director and writers behind “The East Palace”
The streamer says its next Korean mystery drama, centered on a cold-blooded criminal psychologist who probes unsolved murders, is in production and has set a cast for “Materesa (WT).”
FTC and 22 States Sue Amazon, Alleging It Secretly Marked Up Ads Shown to Marketplace Sellers
The federal competition regulator and a coalition of states claim Amazon undercut third-party sellers on its platform by allegedly embedding surcharges into advertising terms.
FTC lawsuit by 22 states targets Amazon’s ad auction pricing, putting focus on high-margin advertising
The U.S. Federal Trade Commission says Amazon.com secretly inflated prices in its advertising auctions for more than seven years, while states joined the agency in the legal challenge.
Jensen Huang’s “Buy at a Discount” remark returns to focus as Nvidia shares rise and an AI basket gains
A CEO message to investors in June has been replayed after Nvidia’s stock moved higher over the following months, alongside gains in a broader AI peer group. Analysts caution that short-term trading often reflects many forces beyond a single CEO comment.
AMD says it is expanding its AI infrastructure footprint in Saudi Arabia
The chip designer announced a new platform initiative in Saudi Arabia, while investors appeared focused on how quickly the move could translate into additional AI-related revenue. AMD shares were little changed in Monday premarket trading.
Nvidia shares show a rare trading pattern, underscoring how investors are rethinking semiconductor correlations
A market-linked read of Nvidia’s stock behavior suggests its relationship with broader semiconductor moves has shifted, a change that can affect hedging, positioning, and how traders interpret near-term momentum.