Apple Sues NSO Group Over FORCEDENTRY Exploit and Pegasus Spyware Targeting

Apple files a federal lawsuit against NSO Group and its parent company Q Cyber Technologies in the US District Court for Northern California, seeking to hold the Israeli spyware firm accountable for surveillance and targeting of Apple users. The complaint provides new technical details about NSO Group’s FORCEDENTRY exploit, a sophisticated zero-click vulnerability that bypassed Apple’s BlastDoor security protections to install the latest version of Pegasus spyware on victims’ devices without any user interaction.

Apple alleges that NSO Group violated the Computer Fraud and Abuse Act (CFAA), California’s Unfair Competition Law, and the terms of use for Apple’s iCloud service. The company seeks a permanent injunction to ban NSO Group from using any Apple software, services, or devices. Alongside the lawsuit, Apple announces a $10 million contribution to support cybersurveillance researchers and advocates, including grants to organizations like Citizen Lab that have exposed NSO’s abuses.

This marks the second major technology company lawsuit against NSO Group in two years, following WhatsApp’s 2019 litigation. In January 2024, US District Judge William Donato denies NSO’s motion to dismiss Apple’s case “in all respects” and rejects arguments that Apple should be required to bring its lawsuit in Israel. However, in September 2024, Apple moves to voluntarily dismiss the lawsuit, citing concerns that discovery could reveal key elements of its cyber defensive measures to other spyware vendors, highlighting the complex challenges technology companies face in holding surveillance firms legally accountable while protecting their security infrastructure.