Judge rules that NSO cannot continue to install spyware via WhatsApp pending appeal

A California federal judge on Friday declined to stay an order preventing the NSO Group from using WhatsApp infrastructure to mount spyware attacks.

NSO Group had sought to stay the order pending a decision on its appeal in the case, which centers on allegations that it targeted 1,400 WhatsApp users with its powerful zero-click Pegasus spyware in 2019.

The spyware manufacturer has said that the permanent injunction will cause “catastrophic” damage to its business and that it will “suffer irreparable, potentially existential injuries” as a result.

“The court does not find that defendants have made a strong showing of likelihood

of success on the merits of their arguments regarding liability,” the opinion says. 

“Even based only on the limited discovery provided by defendants, the undisputed evidence showed that NSO went far beyond their authorized use of Whatsapp by reverse-engineering the application to design a spyware vector which allowed NSO’s clients to surveil Whatsapp’s users and obtain data from its servers.” 

The judge did issue a limited administrative stay of up to 45 days to allow NSO Group to ask an appeals court to weigh in.

Get more insights with the

Recorded Future

Intelligence Cloud.

Learn more.

No previous article

No new articles

Suzanne Smalley

Suzanne Smalley

is a reporter covering privacy, disinformation and cybersecurity policy for The Record. She was previously a cybersecurity reporter at CyberScoop and Reuters. Earlier in her career Suzanne covered the Boston Police Department for the Boston Globe and two presidential campaign cycles for Newsweek. She lives in Washington with her husband and three children.

 

Total
0
Shares
Previous Post

Fake WhatsApp API Package on npm Steals Messages, Contacts, and Login Tokens

Next Post

Cyber spies use fake New Year concert invites to target Russian military

Related Posts

China-Linked APT Exploits Sitecore Zero-Day in Attacks on American Critical Infrastructure

A threat actor likely aligned with China has been observed targeting critical infrastructure sectors in North America since at least last year. Cisco Talos, which is tracking the activity under the name UAT-8837, assessed it to be a China-nexus advanced persistent threat (APT) actor with medium confidence based on tactical overlaps with other campaigns mounted by threat actors from the region.
Read More

How Exposed Endpoints Increase Risk Across LLM Infrastructure

As more organizations run their own Large Language Models (LLMs), they are also deploying more internal services and Application Programming Interfaces (APIs) to support those models. Modern security risks are being introduced less from the models themselves and more from the infrastructure that serves, connects and automates the model. Each new LLM endpoint expands the attack surface, often in
Read More