WhatsApp Disrupts New NSO Group Spyware Campaign, Files Contempt Order
Published
Key Takeaways
- New Campaign Disrupted: WhatsApp said it caught and stopped spear phishing attempts linked to NSO Group after an investigation prompted by user reports.
- Court Order Violation: WhatsApp filed a contempt order against NSO, accusing it of breaching an injunction barring it from targeting WhatsApp users.
- Damages History: A jury previously ordered NSO to pay $167 million in damages, later lowered to $4 million.
WhatsApp said it disrupted a new hacking campaign linked to NSO Group, accusing the surveillance software maker of violating an earlier court order that bars it from targeting WhatsApp and its users with Pegasus spyware. The Meta-owned platform said it caught and disrupted spear phishing attempts linked to NSO after an investigation prompted by user reports.
How the Attack Worked
Attackers tried to trick people into clicking malicious links designed to drive them to external websites outside of the messaging service, a Monday Meta report said. The company also caught the operators creating test accounts and groups on WhatsApp, which it took down.
The report mentions the following threat domains:
- hxxps://ikhwancast[.]com
- hxxps://ghazacast[.]com
- hxxps://fr24cast[.]com
The platform said the attempts were similar to previous "1-click phishing campaigns." Meta stated that it was backed in May by 12 prominent civil rights organizations, a coalition of security researchers, privacy advocates, and digital rights experts.
Legal Battle and Contempt Filing
Last year, as part of a years-long lawsuit, a court ordered NSO Group to stop targeting WhatsApp and its users. WhatsApp claimed the new campaign violated that injunction and filed a contempt order against NSO.
The injunction stems from a 2019 mass-hacking campaign by NSO that targeted more than 1,400 WhatsApp users. After discovering it, WhatsApp notified victims and sued NSO. A jury later ordered NSO to pay $167 million in damages, which was later reduced to $4 million.
The U.S. government has also put pressure on NSO by placing it on a blocklist, and it has imposed sanctions on other spyware makers, such as Intellexa and its founder.
In April, fake Android apps distributing spyware were linked to Italian surveillance vendor IPS.
Related
Get expert insights on threats, breaches, scams, and security trends — delivered every Monday.
Most Popular
Get expert insights on threats, breaches, scams, and security trends — delivered every Monday.
Most Popular