Meta thought it had stopped NSO Group. It says the spyware firm did not get the message.
The company is filing a federal court contempt order against NSO, the Israeli maker of the Pegasus hacking tool, accusing it of violating a permanent injunction that barred it from ever targeting WhatsApp or its users.
Meta says it has disrupted fresh attacks in the process: new spear-phishing attempts, linked to NSO, that it foiled by dismantling test accounts and groups the firm had created on the platform.
The attempts resembled NSO’s earlier “1-click” campaigns, Meta said in a blog post, the kind of attack where a single tap on a malicious link is enough to compromise a device, with no password required. The links were designed to lure WhatsApp users to external sites. NSO did not respond to a request for comment.
It is the latest turn in a long fight between the two companies.
Last year, a US court ordered NSO to stop targeting WhatsApp, an outcome the spyware firm warned could put it out of business. The judge cut the punitive damages NSO owed Meta sharply, to $4mn from an initial $167mn, but it was the injunction, the order to simply stop, that mattered most.
Meta’s contempt filing argues NSO has ignored it.
NSO is appealing the injunction, and Meta is not fighting alone.
Last month, 12 civil-rights organisations, alongside security researchers, privacy advocates, and digital-rights experts, filed amicus briefs backing Meta against the appeal. The case has become a proxy for a larger question: whether a company blacklisted by the US government, and accused of enabling human-rights abuses through Pegasus, can be forced to stop.
For Meta, the stakes are partly reputational. It has spent recent years positioning WhatsApp as a privacy-first platform and rolling out new anti-scam protections, even as it weathers its own security embarrassments and a pile of unrelated lawsuits.
A messaging app trusted by more than two billion people cannot afford to look like an easy target for commercial spyware.
What makes the spyware industry so hard to shut down is precisely what Meta is now testing in court: that even a clear legal order may not stop a determined vendor, only raise the cost of getting caught.
Meta’s message, in filing for contempt and broadcasting the foiled attacks, is that it intends to keep catching them.
