Israeli spyware firm targeted Whatsapp users despite US court order
A spyware firm founded in Israel has been targeting Whatsapp users in Jordan and Lebanon with malicious links, despite a US court order forbidding it from doing so, according to Meta.
Meta said earlier this week that it had caught and disrupted "spear phishing attempts" by NSO Group on Whatsapp, which had targeted a handful of users in Jordan and Lebanon.
The tech giant said it also caught the spyware firm creating "test accounts and groups" on Whatsapp.
Whatsapp later published the dot-com domains for the one-click infections used by NSO Group, which were "ikhwancast", "ghazacast" and "fr24cast".
John Scott-Railton, of Citizen Lab, queried whether the latter domain was an attempt to impersonate French media outlet France24.
New MEE newsletter: Jerusalem Dispatch
Sign up to get the latest insights and analysis on Israel-Palestine, alongside Turkey Unpacked and other MEE newsletters
NSO Group was founded in Israel and built the infamous Pegasus software, which was able to infiltrate Whatsapp users and harvest their messages, photos, calls and other data.
The company has been under US ownership since last year.
In 2025, NSO Group lost a court case against Meta over its targeting of Whatsapp users, and was ordered to pay the tech giant $167m. That was later reduced to just $4m, however NSO Group was permanently barred from targeting Whatsapp and its users.
Meta said that the latest breaches showed that NSO Group was violating the court order.
Trying to get off blacklist
NSO Group has been on a blacklist that stops it from doing business with US companies unless it gets specific approval, after former President Joe Biden's administration deemed it to have been acting against US foreign policy and national security interests.
Reports have suggested that NSO Group has been seeking to get itself off the blacklist now under President Donald Trump.
Last year, NSO Group appointed David Friedman, the US ambassador to Israel under Trump's first term from 2017 to 2021, as its executive chair.
The heartbreaking moment when Chair of the #FinsburyParkMosque, Mohammed Kozbar, had to explain to his son that his phone was hacked
— Middle East Eye (@MiddleEastEye) August 1, 2022
Follow along for the complete #DigitalNightmare video#Pegasus #PegasusSpyware pic.twitter.com/EnfX4Du7hx
NSO Group did not respond to a request for comment earlier this week from the Guardian.
In 2021, a series of investigations under the coordination of Forbidden Stories showed how Pegasus, NSO Group's flagship product, was used by governments to spy on activists, journalists and political dissidents.
Governments such as Saudi Arabia, Morocco, Bahrain and the UAE were accused of using the spyware.
middleeasteye.net