Meta says a NSO Group-linked spyware entity is still trying to target WhatsApp users through spear-phishing attempts that violate a U.S. court order. Meta states that WhatsApp detected and disrupted “spear phishing” activity associated with NSO Group in Jordan and Lebanon, including efforts to trick users into clicking malicious links. Meta also says it identified NSO Group-linked activity involving the creation of “test accounts and groups” on WhatsApp. According to Meta, the malicious links are intended to drive victims to external websites outside of WhatsApp, similar to phishing techniques previously reported by Meta and others.
Meta is asking a federal court to hold NSO Group in contempt, asserting that the activity contravenes a permanent injunction that bars NSO from targeting WhatsApp or its users. Multiple outlets report Meta’s claim that it believed NSO had stopped and that NSO did not comply with the order. The reporting characterizes the latest activity as attempted social engineering rather than confirmed successful account compromise.
