Judge rules that NSO cannot continue to install spyware via WhatsApp pending appeal

A California federal judge on Friday declined to stay an order preventing the NSO Group from using WhatsApp infrastructure to mount spyware attacks.

NSO Group had sought to stay the order pending a decision on its appeal in the case, which centers on allegations that it targeted 1,400 WhatsApp users with its powerful zero-click Pegasus spyware in 2019.

The spyware manufacturer has said that the permanent injunction will cause “catastrophic” damage to its business and that it will “suffer irreparable, potentially existential injuries” as a result.

“The court does not find that defendants have made a strong showing of likelihood

of success on the merits of their arguments regarding liability,” the opinion says. 

“Even based only on the limited discovery provided by defendants, the undisputed evidence showed that NSO went far beyond their authorized use of Whatsapp by reverse-engineering the application to design a spyware vector which allowed NSO’s clients to surveil Whatsapp’s users and obtain data from its servers.” 

The judge did issue a limited administrative stay of up to 45 days to allow NSO Group to ask an appeals court to weigh in.

Get more insights with the

Recorded Future

Intelligence Cloud.

Learn more.

No previous article

No new articles

Suzanne Smalley

Suzanne Smalley

is a reporter covering privacy, disinformation and cybersecurity policy for The Record. She was previously a cybersecurity reporter at CyberScoop and Reuters. Earlier in her career Suzanne covered the Boston Police Department for the Boston Globe and two presidential campaign cycles for Newsweek. She lives in Washington with her husband and three children.

 

Total
0
Shares
Previous Post

Fake WhatsApp API Package on npm Steals Messages, Contacts, and Login Tokens

Next Post

Cyber spies use fake New Year concert invites to target Russian military

Related Posts

Iranian Hackers Launch ‘SpearSpecter’ Spy Operation on Defense & Government Targets

The Iranian state-sponsored threat actor known as APT42 has been observed targeting individuals and organizations that are of interest to the Islamic Revolutionary Guard Corps (IRGC) as part of a new espionage-focused campaign. The activity, detected in early September 2025 and assessed to be ongoing, has been codenamed SpearSpecter by the Israel National Digital Agency (INDA). "The
Read More

[Webinar] Learn How Leading Security Teams Reduce Attack Surface Exposure with DASR

Every day, security teams face the same problem—too many risks, too many alerts, and not enough time. You fix one issue, and three more show up. It feels like you’re always one step behind. But what if there was a smarter way to stay ahead—without adding more work or stress? Join The Hacker News and Bitdefender for a free cybersecurity webinar to learn about a new approach called Dynamic Attack
Read More

Critical RSC Bugs in React and Next.js Allow Unauthenticated Remote Code Execution

A maximum-severity security flaw has been disclosed in React Server Components (RSC) that, if successfully exploited, could result in remote code execution. The vulnerability, tracked as CVE-2025-55182, carries a CVSS score of 10.0. The vulnerability has been codenamed React2shell. It allows "unauthenticated remote code execution by exploiting a flaw in how React decodes payloads sent to React
Read More