Threat reportMalwareTL-2026-3914
WhatsApp contempt bid against NSO Group denied: alleged post-injunction spearphishing of WhatsApp users (Pegasus)
WhatsApp contempt bid against NSO Group denied (TL-2026-3914), also tracked as WhatsApp Inc. v. NSO Group Technologies, is a medium-severity malware campaign, first published 2026-10-19. It is attributed to NSO Group (Israel) with low confidence, affects Meta WhatsApp, maps to 5 MITRE ATT&CK techniques (T1204.001, T1566.002, T1583.001), and is covered by 9 detection rules and 10 indicators of compromise.
- Severity
- MEDIUMAssessed severity
- CVEs
- 0None referenced
- Techniques
- 5MITRE ATT&CK
- Actors
- 1NSO Group
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 10Indicators of compromise
Key facts for TL-2026-3914
- Threat ID
- TL-2026-3914
- Also known as
- WhatsApp Inc. v. NSO Group Technologies, NSO post-injunction contempt motion
- Severity
- MEDIUM
- Status
- MONITORING
- Category
- MALWARE
- First published
- Last reviewed
- Attribution
- NSO Group
- Attribution confidence
- LOW
- Nation-state nexus
- Israel
- Motivation
- UNKNOWN
- Target sectors
- civil society, news - media, government administration, academia
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 10
Malware and tooling in WhatsApp contempt bid against NSO Group denied
Malware and tooling: Chrysaor
How WhatsApp contempt bid against NSO Group denied works
A Northern District of California judge (Phyllis Hamilton) denied WhatsApp's motion to hold NSO Group in contempt for allegedly violating the 2025 permanent injunction with spearphishing attacks, finding WhatsApp lacked clear and convincing evidence. WhatsApp's June 2026 filing identified 23 accounts and 34 groups it linked to NSO testing, plus three phishing domains.
Background: In WhatsApp v. NSO Group, the court granted summary judgment on liability on 2024-12-20, a jury awarded about $167.3 million in punitive and $444,719 in compensatory damages on 2025-05-06, and Judge Hamilton reduced the total to roughly $4 million via a 9:1 punitive ratio cap while issuing a permanent injunction in October 2025 (sources give 17 or 18 October). The case concerned a 2019 campaign in which NSO's Pegasus spyware was delivered through WhatsApp servers (the 'WhatsApp Installation Server') to approximately 1,400 users, including journalists, human rights defenders and diplomats. The injunction, reported as enforceable from 2026-01-28, bars NSO from accessing or targeting WhatsApp and its users, creating WhatsApp accounts, using technology that interacts with the platform, and requires deletion of code related to Meta's platforms.
Allegations: On 2026-06-08 Meta/WhatsApp announced it had disrupted NSO-linked social engineering after investigating user reports, and filed a contempt motion. WhatsApp said the activity involved spearphishing messages with malicious links redirecting users to external websites outside WhatsApp, similar to previously reported 1-click phishing campaigns, rather than zero-click exploitation. It published three domains (ikhwancast.com, ghazacast.com, fr24cast.com) so potential victims could check other messaging and email channels. Per the contempt filing as reported, at least 23 WhatsApp accounts and 34 groups linked to NSO were created between 2026-01-28 and early June 2026 and used for 'testing', and one-click malicious URL links tailored to individual targets were sent in February and April 2026. Meta did not publicly disclose user counts, success rates or attribution methodology.
Outcome: As reported by The Record on 2026-10-19, Judge Hamilton denied the contempt bid because WhatsApp did not provide clear and convincing evidence. The sole testimony came from Meta security engineer Andrew Blaich, who described 23 new accounts with registration patterns, device and related information, and connections to known NSO-controlled infrastructure. The judge said plaintiffs 'took a calculated risk in choosing to limit the level of detail in their supporting evidence'. Advocates noted that disclosing detection methods would benefit NSO and foreign intelligence services. The violation is therefore alleged and unproven; no CVE, malware sample hash or payload analysis is stated in the sources, and the phishing domains are WhatsApp-published indicators whose NSO link was not established in court.
MITRE ATT&CK techniques used in TL-2026-3914
Execution
Initial Access
T1566.002 Spearphishing Link; T1660 Phishing
Resource Development
Affected products and versions in WhatsApp contempt bid against NSO Group denied
- Meta — WhatsApp
Remediation for WhatsApp contempt bid against NSO Group denied
Immediate actions
- Block ikhwancast.com, ghazacast.com and fr24cast.com at DNS, proxy and email gateways
- Search web proxy, DNS and mail/chat logs for the three domains to identify potentially targeted users
- Advise high-risk users (journalists, activists, politicians, academics) not to open unsolicited links received over WhatsApp
Longer-term hardening
- Keep WhatsApp and mobile OS patched on at-risk users' devices
- Report suspicious WhatsApp messages to WhatsApp so the accounts can be disrupted
Timeline of WhatsApp contempt bid against NSO Group denied
- 2019 Pegasus campaign delivered via WhatsApp servers compromised about 1,400 users (sources give year only; date is a placeholder for 2019)
- Court granted summary judgment finding NSO liable in WhatsApp v. NSO Group
- Jury awarded about $167.3M punitive and $444,719 compensatory damages against NSO
- Judge Hamilton issued a permanent injunction barring NSO from targeting WhatsApp and reduced damages to roughly $4M (sources differ between Oct 17 and Oct 18)
- Injunction reportedly became enforceable; NSO-linked accounts and groups were allegedly created from this date
- Per the contempt filing, NSO allegedly sent one-click malicious URL links to targeted users in February 2026 (month only sourced)
- Per the contempt filing, further one-click malicious links allegedly sent in April 2026 (month only sourced)
- WhatsApp/Meta announced disruption of NSO-linked spearphishing, published three domains and filed a contempt motion
- The Record reported Judge Hamilton denied the contempt bid for lack of clear and convincing evidence
Sources cited for WhatsApp contempt bid against NSO Group denied
- Judge denies WhatsApp's bid to hold spyware maker in contempt for allegedly targeting users
- Meta Blocks NSO Group's New WhatsApp Phishing Attack, Files Contempt Order
- WhatsApp says it disrupted new NSO spyware phishing attacks
- WhatsApp takes NSO Group back to court for violating its spyware ban
- US court blocks spyware vendor NSO Group from targeting WhatsApp users
- US court bans Israeli spyware company NSO from targeting WhatsApp after Meta lawsuit
Detection coverage for TL-2026-3914
As of 2026-10-19, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3914 across Splunk SPL, Microsoft KQL and Sigma, covering 10 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.
Community OSINT corroboration for TL-2026-3914
6 of this threat's indicators have also been reported by the open-source security community. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.