Meta says NSO targeted WhatsApp users again

Meta said Monday that the Israeli spyware company NSO Group was linked to new hacking attempts targeting WhatsApp users, conduct the company says may breach a federal court order already restricting the firm’s access to the messaging service.

The immediate consequence is legal as much as technical: if Meta can show NSO used WhatsApp again after the court’s prohibition, the company could ask a judge to enforce or expand sanctions against a firm whose surveillance tools have long drawn scrutiny from regulators, courts and rights groups, officials said.

Background

The disclosure lands after years of litigation between Meta’s WhatsApp unit and NSO Group over the use of spyware delivered through the platform. WhatsApp has argued in court that NSO used its infrastructure to help deploy malicious code against selected users. NSO, an Israeli firm best known for the Pegasus spyware suite, has said its technology is sold to government clients for law-enforcement and national-security purposes, according to public filings and prior reporting. But the legal fight has turned on a narrower question: whether NSO can access or route attacks through WhatsApp’s systems without authorization.

That matters because a court prohibition is not a policy warning. It is a binding order. If a defendant acts in conflict with that order, the issue stops being a dispute about acceptable platform conduct and becomes a question of compliance with judicial authority. Meta did not, in the signal available here, identify the exact users targeted, the jurisdictions involved or the technical pathway used in the latest attempts. Still, the company’s framing was direct: the activity was tied to NSO Group and happened after the earlier court restriction.

The case sits at the intersection of platform security and surveillance law. Spyware of this kind is designed to compromise a device, extract data, activate sensors or preserve covert access, depending on the tool and configuration. Messaging services such as WhatsApp are attractive vectors because they are trusted, global and deeply integrated into a user’s daily communications. That has made them recurring terrain in broader disputes over commercial spyware, including debates at the White House, in Congress and across foreign governments. Readers following federal courts’ treatment of technology platforms may also see echoes in other disputes over executive power and legal limits, including Judge strikes down Trump’s $100,000 H-1B fee.

What this means

Meta’s allegation raises two practical questions now. First, can the company tie the new activity to NSO strongly enough to satisfy a federal judge? Second, if it can, what remedy will it seek? Courts have tools available — contempt findings, compliance orders, discovery demands, and monetary sanctions among them — but those tools depend on a clear factual showing. And in cyber cases, attribution is always the hinge. Technical indicators may be persuasive, yet they still have to survive adversarial scrutiny.

There is a larger policy consequence as well. If a court order proved unable to keep a blacklisted spyware vendor off a major communications platform, that would expose the limits of platform-by-platform enforcement. The result: pressure shifts toward export controls, procurement bans and coordinated cross-border restrictions rather than private litigation alone. The United States has already moved against commercial spyware in other settings, and international concern has been building for years through reporting and official reviews by bodies including the Reuters and the BBC.

NSO’s legal exposure also extends beyond a single app. A finding that the company disregarded a federal prohibition would strengthen the argument, advanced by critics of the spyware industry, that ordinary civil remedies are too slow and too narrow for firms operating through government clients and cross-border infrastructure. But Meta still has to prove the link. Allegation is one thing; a judicial finding is another.

That distinction matters because spyware litigation often mixes hard technical evidence with inference about operators, customers and infrastructure. Courts can handle that. They do it through discovery, expert reports, injunction practice and contempt proceedings, not headline rhetoric. For anyone watching the procedural mechanics, this is where the real contest now sits. And it may shape how other platforms draft their terms of service, preserve logs and frame future claims against surveillance vendors. Separate legal fights over federal authority and institutional compliance — different subject, same basic question of enforceable limits — have also surfaced in cases such as Lawsuit seeks to stop White House UFC event and Trump Denies No-War Pledge Despite Past Statements.

A court prohibition is not a policy warning — it is a binding order.

What to watch next is concrete: whether Meta returns to federal court with a motion to enforce the existing order, seeks contempt findings, or asks for expanded injunctive relief. If that filing comes, it should provide the first real detail on attribution, targets and method. Until then, the allegation is serious, the legal stakes are clear, and the next move belongs to the court. (The committee has not responded to requests for comment.)