# NSO Group Pegasus Spyware — WhatsApp Spearphishing Campaign Alleged in Meta Contempt Complaint (June 2026)

> On June 8, 2026 Meta filed a federal contempt-of-court motion alleging NSO Group violated the October 2025 permanent injunction (entered after WhatsApp's 2025 trial win and $168M judgment) by running a new spearphishing campaign against WhatsApp users. The activity used social-engineering messages with malicious links redirecting victims to external attacker-controlled websites — consistent with prior 1-click NSO Pegasus delivery — and involved attacker-created WhatsApp test accounts and groups that were later removed.

- **Published:** 2026-06-09T00:00:00Z
- **Last reviewed:** 2026-06-09T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0728
- **ID:** TL-2026-0728
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Actor:** NSO Group (Israel)
- **Detections:** 9 · **IOCs:** 15 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2019-3568, CVE-2021-30860, CVE-2023-41064, CVE-2023-41061

## Description

Meta/WhatsApp disclosed and disrupted a fresh social-engineering campaign it attributes to commercial-spyware vendor NSO Group, the developer of the Pegasus mercenary surveillance platform. According to Meta's June 8, 2026 contempt filing, attackers attempted to trick WhatsApp users into clicking malicious links that drove them to external websites outside of WhatsApp — a delivery pattern Meta describes as 'similar to previously reported 1-click phishing campaigns linked to NSO.' As part of the operation, NSO-linked actors created test accounts and groups on WhatsApp that Meta subsequently identified and removed. WhatsApp shared threat indicators so potential targets could determine whether they had been approached via text message, email, WhatsApp message, or other channels.

The campaign is significant because it allegedly continues conduct already barred by a U.S. court. WhatsApp won its civil suit against NSO Group, securing roughly $168 million in damages (later reduced on review) and, in October 2025, a permanent injunction restraining NSO from targeting WhatsApp infrastructure and users. NSO Group is appealing. A contempt motion asks the same court to enforce its existing injunction with coercive sanctions — potential fines, asset actions, or other penalties — rather than starting a new case. Meta tied the filing to broader policy advocacy, arguing that easing restrictions on NSO would undermine U.S. national security, and noting NSO Group's placement on the U.S. Commerce Department Entity List since November 2021. Citizen Lab researcher John Scott-Railton commented that 'NSO's own actions make the strongest argument for why they should stay on the Entity list.'

The operation echoes a long, well-documented history of NSO Pegasus deployment against journalists, lawyers, and human-rights defenders. Pegasus has historically been delivered via WhatsApp through the 2019 zero-click VOIP exploit (CVE-2019-3568) that NSO used against more than 1,400 devices in a two-week window, and via Apple iMessage zero-click/one-click exploit chains including KISMET, FORCEDENTRY (CVE-2021-30860), FINDMYPWN, PWNYOURHOME, and BLASTPASS (CVE-2023-41064 / CVE-2023-41061). A 2024 Access Now / Citizen Lab investigation documented at least 35 Jordanian journalists, activists, and human-rights lawyers targeted between 2019 and 2023, frequently via malicious WhatsApp and SMS links sent by operators posing as journalists requesting interviews. The June 2026 campaign reuses the social-engineering and external-redirect tradecraft from those operations even though the specific exploit payload behind the 2026 links was not enumerated in public reporting.

No CVE, CVSS, or concrete network IOC was published for the 2026 campaign itself; WhatsApp privately distributed indicators to affected users. Defensive value therefore centers on behavioral detection of spearphishing-link social engineering on messaging platforms, attacker test-account/group creation patterns, redirects to attacker-controlled external sites, and the established Pegasus post-exploitation behaviors on compromised mobile devices.

## MITRE ATT&CK

- T1598 Phishing for Information
- T1589 Gather Victim Identity Information
- T1583 Acquire Infrastructure
- T1585 Establish Accounts
- T1588 Obtain Capabilities
- T1566 Phishing
- T1660 Phishing
- T1456 Drive-By Compromise
- T1203 Exploitation for Client Execution
- T1658 Exploitation for Client Execution
- T1070 Indicator Removal
- T1628 Hide Artifacts
- T1630 Indicator Removal on Host
- T1417 Input Capture
- T1426 System Information Discovery
- T1636 Protected User Data
- T1429 Audio Capture
- T1430 Location Tracking
- T1409 Stored Application Data
- T1071 Application Layer Protocol
- T1573 Encrypted Channel
- T1437 Application Layer Protocol
- T1646 Exfiltration Over C2 Channel

## Sources

- [Meta accuses NSO Group of defying spyware injunction, files contempt of court complaint](https://cyberscoop.com/meta-contempt-complaint-nso-group-spyware/)
- [Meta claims NSO Group still targets WhatsApp users despite court order](https://www.helpnetsecurity.com/2026/06/08/meta-whatsapp-nso-group-phishing-campaign/)
- [NVD — CVE-2019-3568 (WhatsApp VOIP buffer overflow)](https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2019-3568)
- [Facebook Security Advisory — CVE-2019-3568](https://www.facebook.com/security/advisories/cve-2019-3568)
- [CISA Known Exploited Vulnerabilities Catalog — CVE-2019-3568](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)
- [Citizen Lab — BLASTPASS: NSO Group iPhone Zero-Click, Zero-Day Exploit Captured in the Wild](https://citizenlab.ca/blastpass-nso-group-iphone-zero-click-zero-day-exploit-captured-in-the-wild/)
- [Citizen Lab — FORCEDENTRY: NSO Group iMessage Zero-Click Exploit Captured in the Wild](https://citizenlab.ca/research/forcedentry-nso-group-imessage-zero-click-exploit-captured-in-the-wild/)
- [Citizen Lab — HIDE AND SEEK: Tracking NSO Group's Pegasus Spyware to Operations in 45 Countries](https://citizenlab.ca/research/hide-and-seek-tracking-nso-groups-pegasus-spyware-to-operations-in-45-countries/)
- [Amnesty International — Forensic Methodology Report: How to catch NSO Group's Pegasus](https://securitylab.amnesty.org/latest/2021/07/forensic-methodology-report-how-to-catch-nso-groups-pegasus/)
- [Access Now — New spyware attacks exposed: civil society targeted in Jordan](https://www.accessnow.org/press-release/pegasus-spyware-jordan/)
- [The Hacker News — Pegasus Spyware Targeted iPhones of Journalists and Activists in Jordan](https://thehackernews.com/2024/02/pegasus-spyware-targeted-iphones-of.html)
- [Human Rights Watch — Spyware Targets Human Rights Watch Staff in Jordan](https://www.hrw.org/news/2024/02/01/spyware-targets-human-rights-watch-staff-jordan)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0728