WhatsApp flags new spyware attempt on users

WhatsApp has disrupted a sophisticated spyware campaign targeting users on its platform and linked the operation to Israeli surveillance firm NSO Group, which develops the Pegasus software.

The Meta-owned messaging service said it uncovered and stopped the hacking activity after an internal investigation triggered by user reports. It also said the attackers used malicious links designed to trick users into leaving WhatsApp and exposing their devices.

According to the company, the methods used match patterns previously associated with Pegasus infections. These include one-click phishing tactics that redirect users to external websites where their devices can be compromised.

The company said it also detected fake accounts and group activity created by NSO-linked operators. It removed these accounts as part of its response. Meanwhile, WhatsApp is now asking a US court to hold NSO in contempt of a permanent injunction issued last year.

That injunction barred NSO from targeting WhatsApp or its users again. However, WhatsApp argues that the latest activity shows continued violations of the court order. As a result, the dispute has escalated into a broader legal battle that began in 2019.

WhatsApp said it is also publishing technical indicators from the campaign. This allows users and researchers to check whether they may have been targeted across messaging apps, email, or SMS services.

The platform added that NSO’s leadership has previously acknowledged in court that the firm continues to explore new ways to access devices. These include methods beyond messaging apps, such as browsers and operating systems.

Over the years, Pegasus spyware has been linked to surveillance of journalists, activists, humanitarian workers, and government officials in multiple countries. The case has become central to global debates on commercial spyware regulation.

The company first sued NSO Group in 2019 after a vulnerability was allegedly used to target about 1,400 users globally. A US court later ruled in WhatsApp’s favour and issued a permanent injunction against the firm.

In response to the latest developments, WhatsApp said it is increasing support for anti-spyware efforts. It is also contributing to an industry fund focused on forensic research, user protection, and advocacy against commercial surveillance tools.

Meanwhile, WhatsApp urged users to update their apps regularly and strengthen security settings. It also recommended enabling stricter account protections for users who may be at higher risk of targeted attacks.