WhatsApp Secures Ban on NSO Group After 6-Year Legal Battle

In the latest ruling in a lengthy legal battle, NSO Group was barred from targeting WhatsApp users after hacking into and installing spyware on thousands of devices, with the company ordered to pay $4 million in damages and a permanent injunction preventing reverse-engineering of WhatsApp or the creation of new accounts. The case began when WhatsApp filed the suit in 2019 after Pegasus spyware was distributed to roughly 1,400 mobile devices via a zero-day vulnerability tracked as CVE-2019-3568.

The vulnerability allowed remote code execution through RTCP packets sent to a target phone number, and the spyware was downloaded onto devices when users received targeted calls. In a 17 October ruling, Judge Phyllis J. Hamilton said NSO’s activity posed direct harm to WhatsApp and its users, and the court granted partial summary judgment for the plaintiffs under CFAA and CDAFA, plus breach of contract.

Under the permanent injunction, NSO must delete and destroy all WhatsApp source code it possesses, and the company’s ability to reverse-engineer or create new accounts is halted. Meta’s Will Cathcart welcomed the decision, saying it bans NSO from ever targeting WhatsApp and its global users again.