WhatsApp has asked a US court to hold a blacklisted spyware firm in contempt, after claiming it has violated a permanent injunction banning it from targeting users.

The messaging giant said on June 8 that it “successfully disrupted” social engineering attempts linked to Israeli firm NSO Group after investigating user complaints.

“They tried to trick people into clicking on malicious links to drive them to external websites outside of WhatsApp, similar to previously reported one-click phishing campaigns linked to NSO,” it said. 

“We also caught them creating test accounts and groups on WhatsApp, which we took down.”

Read more on NSO Group: Facebook Takes Spyware Firm NSO Group to Court.

Last year, the commercial spyware firm was ordered to pay damages of over $167m after hacking into about 1400 WhatsApp users' devices.

That ruling was the culmination of a six-year court case which began after Meta engineers detected attempts by NSO to use its spyware tool, Pegasus, to target WhatsApp users including human rights activists, journalists and diplomats.

The zero-click spyware is often used by repressive regimes to monitor opposition figures and activists. There have also been reports that the malware was used to hack Amazon boss Jeff Bezos’s phone.

In 2021, NSO Group was added to the US Commerce Department’s Entity List to prevent it from buying components from American companies.

WhatsApp said the firm should be held in contempt of court to send a clear message.

“When a malicious company on the US government’s Entity List continues to defy US courts, existing restrictions must remain firmly in place,” it said.

“Easing them would undermine US national security and put American companies and billions of people worldwide who depend on secure communications at risk.”

Fighting Back Against Spyware

NSO Group remains defiant and is appealing its permanent injunction. Last month, 12 civil rights organizations filed amicus briefs to fight the appeal.

In the meantime, WhatsApp said it had made a “significant contribution” to the Spyware Accountability Initiative – a fund dedicated to helping civil society organizations fight back against the threat of spyware.

WhatsApp published three domains used in the alleged NSO Group phishing campaign, so other users can check if they were also targeted. It claimed that attacks might come via email, text message, WhatsApp message “or something else.”

Image credit: Samuel Boivin / Shutterstock.com