WhatsApp disrupts new NSO spyware phishing campaigns

WhatsApp reports that it has identified and blocked spear-phishing operations believed to originate from the NSO Group, following its review of complaints about social engineering tactics.

WhatsApp links the attacks to the sanctioned NSO Group. The NSO Group, an Israeli firm specializing in commercial spyware, developed the sophisticated Pegasus program, which has been directed at politicians, activists, journalists, academics, and additional high-interest targets. Since November 2021 the company has appeared on the U.S. sanctioned entities list for providing software to foreign governments that ended up being used on individuals and groups inside the United States. NSO tools were likewise employed by repressive regimes to pursue dissidents beyond their own borders.

Meta previously secured a court victory against NSO. WhatsApp’s parent company, Meta, pursued legal action against the NSO Group in American courts and obtained a permanent injunction in 2025 along with a finding of responsibility for 1,400 infections and a related $167,000,000 fine. Meta’s newest statement indicates that those earlier decisions failed to stop the NSO Group from continuing its operations against selected WhatsApp users.

The latest attacks used social engineering and test accounts. Evidence suggests the operators sought to persuade victims to tap harmful links leading to outside web pages, echoing earlier recorded one-click phishing operations tied to NSO. “We successfully disrupted NSO-linked social engineering attempts, after investigating user reports,” Meta says. “They tried to trick people into clicking on malicious links to drive them to external websites outside of WhatsApp, similar to previously reported 1-click phishing campaigns linked to NSO.” The company further stated that it identified the creation of test accounts and groups on WhatsApp and subsequently removed them.

Meta lists domains tied to the campaigns. The company published three domains as indicators of compromise from the incidents it uncovered: ikhwancast[.]com, ghazacast[.]com, and fr24cast[.]com. Meta maintains that the conduct breaches the 2025 judicial ruling imposing a permanent injunction on the NSO Group that bars the spyware maker from directing efforts at WhatsApp or its user base.

Meta highlights ongoing national security risks. In its update Meta underscores the danger the NSO Group represents to national security, referencing the spyware firm’s CEO testimony in court regarding the pursuit of entry methods apart from WhatsApp and reiterating the firm’s placement on the U.S. sanctions roster. WhatsApp pointed out that its end-to-end encryption successfully shields users’ messages and calls from Pegasus as well as comparable spyware, while urging people to keep their applications and operating systems current for maximum safety. Android users can turn on Advanced Protection and iOS users can activate Lockdown Mode; both features were created to shrink the attack surface and limit data exposure to spyware.