Israeli spyware firm targeted Whatsapp users despite US court order

What Happened

Meta said it caught and disrupted spear-phishing attempts by the spyware firm NSO Group on WhatsApp, targeting a handful of users in Jordan and Lebanon. The company published three dot-com domains used for one-click infections: 'ikhwancast', 'ghazacast', and 'fr24cast'. NSO Group also created test accounts and groups on WhatsApp. The activity violates a permanent US court order barring NSO Group from targeting WhatsApp and its users, issued after a 2025 court case in which NSO was ordered to pay $167 million—later reduced to $4 million—in damages to Meta. NSO Group did not respond to a request for comment from the Guardian.

Key Actors

Why It Matters

The incident demonstrates that court orders and blacklists may not effectively constrain commercial spyware actors, posing risks to the integrity of encrypted messaging platforms and to users in sensitive regions. The targeting of individuals in Jordan and Lebanon—combined with NSO's appointment of a Trump-era diplomat—raises concerns about the intersection of private surveillance technology, US foreign policy, and impunity for past misuse, as documented by the Forbidden Stories investigation tying Pegasus to state-sponsored surveillance by Saudi Arabia, Morocco, Bahrain, and the UAE.

Watch For

Potential legal enforcement actions—such as contempt proceedings—against NSO Group for violating the permanent injunction; whether the Trump administration moves to remove NSO from the US blacklist; any official responses from Jordan or Lebanon regarding the targeting of their citizens; and further technical disclosures from Meta or Citizen Lab about NSO's current infrastructure and methods.