NSO Group Israelis Continue to Spy on WhatsApp Users: Meta Blocks Them
WhatsApp has once again blocked NSO Group's attempts, interrupting a series of social engineering attacks directed at users. The Meta-owned company has accused the Israeli spyware firm of violating a permanent injunction issued by a U.S. court, thereby reinforcing its legal stance against a reality already blacklisted for actions contrary to U.S. national security.
The saga traces back to 2025, when WhatsApp obtained a landmark ruling prohibiting NSO Group from targeting the platform and its users. The court had clearly established that NSO had violated federal and state hacking laws. Despite this, recent investigations by WhatsApp, triggered by user reports, revealed new intrusion attempts. The operations exploited social engineering techniques to induce victims to click on malicious links, redirecting them to sites outside the platform, recalling previously documented "1-click" phishing campaigns. NSO was also reported to have created trial accounts and groups on WhatsApp, promptly removed by the company.
Meta Blocks NSO Group on WhatsApp Again
WhatsApp provided threat indicators, including malicious domains such as ikhwancast[.]com, ghazacast[.]com, and fr24cast[.]com, to allow anyone to verify if they have been the target of similar spying attempts on any platform, not just through WhatsApp messages, but also via email or SMS.
The threat posed by NSO Group was further illustrated by the CEO's confirmation in court, admitting to searching for "vectors, or ways to access the phone" that extend beyond WhatsApp, targeting browsers, operating systems, and other applications. No technology is off-limits for paid surveillance companies, whose targets range from journalists and government officials to military personnel and humanitarian organizations. Meta emphasized that NSO Group's persistent activities, despite sanctions and U.S. rulings, represent a direct threat to national security and endanger both American companies and billions of people worldwide who rely on secure communications.
The Fight Against Spyware Cannot Be Fought Alone
WhatsApp reiterated the importance of collaboration, citing the support of organizations like Citizen Lab, which helped notify the victims of the NSO attack in 2019, and a coalition of 12 major civil rights organizations, security researchers, privacy activists, and digital rights experts who filed petitions in support of the permanent injunction against NSO. WhatsApp also announced a significant contribution to the Spyware Accountability Initiative (SAI), which supports dozens of global organizations engaged in forensic research, user support, and advocacy.
Examples of successes include a zero-day discovery by Citizen Lab that led to a security update from Apple for over a billion devices, and the first criminal conviction of executives from a spyware company in Greece, a case built on forensic evidence and civil society investigations. This work, often dangerous and underfunded compared to the spyware industry, is crucial for privacy protection.
For user protection, WhatsApp emphasized that personal messages and calls remain protected by default end-to-end encryption. Users are advised to keep apps and devices updated, report suspicious activity, and enable strict account settings on WhatsApp to further enhance security. For mobile devices, Android users can activate "Advanced Protection," while iOS users can enable "Lockdown Mode," both designed to reduce the attack surface and data exposure to spyware.