Israeli spyware firm targeted Whatsapp users despite US court order

A spyware firm founded in https://www.middleeasteye.net/countries/israel">Israel has been targeting Whatsapp users in https://www.middleeasteye.net/countries/jordan">Jordan and https://www.middleeasteye.net/countries/lebanon">Lebanon with malicious links, despite a https://www.middleeasteye.net/countries/us">US court order forbidding it from doing so, according to Meta. 

Meta said earlier this week that it had caught and disrupted "spear phishing attempts" by NSO Group on Whatsapp, which had targeted a handful of users in Jordan and Lebanon.

The tech giant said it also caught the spyware firm creating "test accounts and groups" on Whatsapp.

Whatsapp later https://x.com/jsrailton/status/2063987149267931448?s=20">published the dot-com domains for the one-click infections used by NSO Group, which were "ikhwancast", "ghazacast" and "fr24cast".

John Scott-Railton, of Citizen Lab, https://x.com/jsrailton/status/2063987149267931448?s=20">queried whether the latter domain was an attempt to impersonate French media outlet France24.

NSO Group was founded in Israel and built the infamous Pegasus software, which was able to infiltrate Whatsapp users and harvest their messages, photos, calls and other data.

The company has been under US ownership since last year.

In 2025, NSO Group lost a court case against Meta over its targeting of Whatsapp users, and was ordered to pay the tech giant $167m.

That was later reduced to just $4m, however NSO Group was permanently barred from targeting Whatsapp and its users.

Meta said that the latest breaches showed that NSO Group was violating the court order. 

Trying to get off blacklist

NSO Group has been on a blacklist that stops it from doing business with US companies unless it gets specific approval, after former President Joe Biden's administration deemed it to have been acting against US foreign policy and national security interests.

Reports have suggested that NSO Group has been seeking to get itself off the blacklist now under President Donald Trump.

Last year, NSO Group appointed David Friedman, the US ambassador to Israel under Trump's first term from 2017 to 2021, as its executive chair.

The heartbreaking moment when Chair of the https://x.com/hashtag/FinsburyParkMosque?src=hash&ref_src=twsrc%5Etfw">#FinsburyParkMosque, Mohammed Kozbar, had to explain to his son that his phone was hacked



Follow along for the complete https://x.com/hashtag/DigitalNightmare?src=hash&ref_src=twsrc%5Etfw">#DigitalNightmare videohttps://x.com/hashtag/Pegasus?src=hash&ref_src=twsrc%5Etfw">#Pegasus https://x.com/hashtag/PegasusSpyware?src=hash&ref_src=twsrc%5Etfw">#PegasusSpyware https://t.co/EnfX4Du7hx">pic.twitter.com/EnfX4Du7hx

— Middle East Eye (@MiddleEastEye) https://x.com/MiddleEastEye/status/1553998974453010432?ref_src=twsrc%5Etfw">August 1, 2022

NSO Group did not respond to a request for comment earlier this week from the Guardian.

In 2021, a series of investigations under the coordination of Forbidden Stories showed how Pegasus, NSO Group's flagship product, was used by governments to spy on activists, journalists and political dissidents.

Governments such as https://www.middleeasteye.net/countries/saudi-arabia">Saudi Arabia, https://www.middleeasteye.net/countries/morocco">Morocco, https://www.middleeasteye.net/countries/bahrain">Bahrain and the https://www.middleeasteye.net/countries/uae">UAE were accused of using the spyware.