WhatsApp Sues NSO Group Over Pegasus Spyware Attack on 1,400 Users

Meta-owned WhatsApp files a federal lawsuit against NSO Group in the US District Court for Northern California, alleging that NSO exploited a zero-day vulnerability (CVE-2019-3568, CVSS score 9.8) in WhatsApp’s voice calling feature to install Pegasus spyware on approximately 1,400 devices across 51 countries. The sophisticated attack leveraged the audio calling vulnerability to deploy spyware without requiring any user interaction, targeting journalists, human rights activists, political dissidents, diplomats, and senior foreign government officials.

The lawsuit reveals that NSO Group’s notorious Pegasus spyware was used to target 1,223 WhatsApp users in a systematic 2019 hacking campaign. WhatsApp alleges that NSO Group violated the federal Computer Fraud and Abuse Act (CFAA) and California’s Comprehensive Computer Data Access and Fraud Act (CDAFA) by accessing WhatsApp’s servers to deploy the malicious code. The case offers a rare glimpse into NSO’s operations, with executives later admitting in depositions that, contrary to public assertions, NSO Group does control data extraction from targets’ devices and the spyware embedding process.

This lawsuit marks the first major legal challenge by a technology platform against a commercial spyware vendor and establishes important precedent for corporate responsibility in enabling surveillance. In December 2024, federal judge Phyllis Hamilton rules NSO Group liable under US law, and a federal jury subsequently orders NSO to pay WhatsApp approximately $168 million in damages, representing a significant legal victory against the commercial spyware industry.