Overview
- Meta filed a federal contempt motion after WhatsApp detected and disrupted spear‑phishing attempts tied to NSO Group that tried to lure users to malicious websites and created test accounts and groups on the platform.
- WhatsApp said the operation used “1‑click” social‑engineering links rather than a WhatsApp zero‑day, and it published three malicious domains (ikhwancast[.]com, ghazacast[.]com, fr24cast[.]com) so others can check for targeting.
- The campaign was small in scale: Meta reported fewer than ten WhatsApp users were targeted, with the majority located in Jordan and Lebanon, and WhatsApp says no successful device compromises were reported.
- Meta’s contempt filing names NSO Group Technologies and Q Cyber and asks the court to treat the activity as a breach of last year’s permanent injunction that barred NSO from targeting WhatsApp users.
- The move reinforces calls by researchers and rights groups for strict enforcement of the U.S. Entity List ban on NSO, signals renewed legal pressure on commercial spyware vendors, and could shape future sanctions and forensic support for victims.