Meta says it disrupted NSO Group‑linked spear‑phishing aimed at WhatsApp users and has asked a US federal court to hold NSO in contempt for allegedly violating an injunction that bars targeting WhatsApp and its users.

The company reports it identified and removed test accounts and groups connected to the activity, and WhatsApp has provided threat indicators to help users detect NSO‑linked social engineering via text, email, WhatsApp, or other channels.

NSO was observed by Meta creating test accounts and groups on WhatsApp, with several malicious domains linked to the activity (fr24cast[.]com, ghazacast[.]com, ikhwancast[.]com).

The incident is framed within broader US–Israel tensions and espionage concerns, though no direct state‑actor link is claimed in the report.

Recommended security measures include enabling two‑step verification, disabling link previews, locking last seen/online status and profile details, and restricting group invitations to known contacts or approved lists.

Technical details about the campaign were sparse, including timing, targets, success rate, and how attribution to NSO was made.

NSO’s Ninth Circuit appeal is supported by an amicus brief arguing that commercial spyware poses a serious threat to free expression and press freedom.

Meta stresses the importance of keeping apps and devices up to date and reporting suspicious activity to aid investigations.

The filing could shift NSO’s image as a legitimate security vendor by focusing on whether NSO crossed a line already set by the court, beyond its technical capabilities.

The Knight Institute describes Pegasus as capable of near‑perfect surveillance, granting full control over a target’s smartphone, including GPS, messages, calls, and more, even with encryption.

John Scott Railton of Citizen Lab notes potential impersonation attempts (e.g., France 24) linked to the new claims, though not confirmed by WhatsApp.

Meta is supporting spyware accountability efforts through donations to the Spyware Accountability Initiative and highlighting Citizen Lab findings that spurred updates and prosecutions against spyware providers.