Judge rules that NSO cannot continue to install spyware via WhatsApp pending appeal

A California federal judge on Friday declined to stay an order preventing the NSO Group from using WhatsApp infrastructure to mount spyware attacks.

NSO Group had sought to stay the order pending a decision on its appeal in the case, which centers on allegations that it targeted 1,400 WhatsApp users with its powerful zero-click Pegasus spyware in 2019.

The spyware manufacturer has said that the permanent injunction will cause “catastrophic” damage to its business and that it will “suffer irreparable, potentially existential injuries” as a result.

“The court does not find that defendants have made a strong showing of likelihood

of success on the merits of their arguments regarding liability,” the opinion says. 

“Even based only on the limited discovery provided by defendants, the undisputed evidence showed that NSO went far beyond their authorized use of Whatsapp by reverse-engineering the application to design a spyware vector which allowed NSO’s clients to surveil Whatsapp’s users and obtain data from its servers.” 

The judge did issue a limited administrative stay of up to 45 days to allow NSO Group to ask an appeals court to weigh in.

Get more insights with the

Recorded Future

Intelligence Cloud.

Learn more.

No previous article

No new articles

Suzanne Smalley

Suzanne Smalley

is a reporter covering privacy, disinformation and cybersecurity policy for The Record. She was previously a cybersecurity reporter at CyberScoop and Reuters. Earlier in her career Suzanne covered the Boston Police Department for the Boston Globe and two presidential campaign cycles for Newsweek. She lives in Washington with her husband and three children.

 

Total
0
Shares
Previous Post

Fake WhatsApp API Package on npm Steals Messages, Contacts, and Login Tokens

Next Post

Cyber spies use fake New Year concert invites to target Russian military

Related Posts

New macOS XCSSET Variant Targets Firefox with Clipper and Persistence Module

Cybersecurity researchers have discovered an updated version of a known Apple macOS malware called XCSSET that has been observed in limited attacks. "This new variant of XCSSET brings key changes related to browser targeting, clipboard hijacking, and persistence mechanisms," the Microsoft Threat Intelligence team said in a Thursday report. "It employs sophisticated encryption and obfuscation
Read More

Cybercriminals Exploit Remote Monitoring Tools to Infiltrate Logistics and Freight Networks

Bad actors are increasingly training their sights on trucking and logistics companies with an aim to infect them with remote monitoring and management (RMM) software for financial gain and ultimately steal cargo freight. The threat cluster, believed to be active since at least June 2025 according to Proofpoint, is said to be collaborating with organized crime groups to break into entities in the
Read More