# WhatsApp contempt bid against NSO Group denied: alleged post-injunction spearphishing of WhatsApp users (Pegasus)

> A Northern District of California judge (Phyllis Hamilton) denied WhatsApp's motion to hold NSO Group in contempt for allegedly violating the 2025 permanent injunction with spearphishing attacks, finding WhatsApp lacked clear and convincing evidence. WhatsApp's June 2026 filing identified 23 accounts and 34 groups it linked to NSO testing, plus three phishing domains.

- **Published:** 2026-10-19T20:48:58Z
- **Last reviewed:** 2026-10-19T20:48:58Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3914
- **ID:** TL-2026-3914
- **Severity:** MEDIUM
- **Category:** MALWARE
- **Status:** MONITORING
- **Actor:** NSO Group (Israel)
- **Detections:** 9 · **IOCs:** 10 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Background: In WhatsApp v. NSO Group, the court granted summary judgment on liability on 2024-12-20, a jury awarded about $167.3 million in punitive and $444,719 in compensatory damages on 2025-05-06, and Judge Hamilton reduced the total to roughly $4 million via a 9:1 punitive ratio cap while issuing a permanent injunction in October 2025 (sources give 17 or 18 October). The case concerned a 2019 campaign in which NSO's Pegasus spyware was delivered through WhatsApp servers (the 'WhatsApp Installation Server') to approximately 1,400 users, including journalists, human rights defenders and diplomats. The injunction, reported as enforceable from 2026-01-28, bars NSO from accessing or targeting WhatsApp and its users, creating WhatsApp accounts, using technology that interacts with the platform, and requires deletion of code related to Meta's platforms.

Allegations: On 2026-06-08 Meta/WhatsApp announced it had disrupted NSO-linked social engineering after investigating user reports, and filed a contempt motion. WhatsApp said the activity involved spearphishing messages with malicious links redirecting users to external websites outside WhatsApp, similar to previously reported 1-click phishing campaigns, rather than zero-click exploitation. It published three domains (ikhwancast.com, ghazacast.com, fr24cast.com) so potential victims could check other messaging and email channels. Per the contempt filing as reported, at least 23 WhatsApp accounts and 34 groups linked to NSO were created between 2026-01-28 and early June 2026 and used for 'testing', and one-click malicious URL links tailored to individual targets were sent in February and April 2026. Meta did not publicly disclose user counts, success rates or attribution methodology.

Outcome: As reported by The Record on 2026-10-19, Judge Hamilton denied the contempt bid because WhatsApp did not provide clear and convincing evidence. The sole testimony came from Meta security engineer Andrew Blaich, who described 23 new accounts with registration patterns, device and related information, and connections to known NSO-controlled infrastructure. The judge said plaintiffs 'took a calculated risk in choosing to limit the level of detail in their supporting evidence'. Advocates noted that disclosing detection methods would benefit NSO and foreign intelligence services. The violation is therefore alleged and unproven; no CVE, malware sample hash or payload analysis is stated in the sources, and the phishing domains are WhatsApp-published indicators whose NSO link was not established in court.

## MITRE ATT&CK

- T1583.001 Domains
- T1585.001 Social Media Accounts
- T1566.002 Spearphishing Link
- T1660 Phishing
- T1204.001 Malicious Link

## Sources

- [Judge denies WhatsApp's bid to hold spyware maker in contempt for allegedly targeting users](https://therecord.media/whatsapp-denied-appeal-alleged-nso-group-violation-injunction)
- [Meta Blocks NSO Group's New WhatsApp Phishing Attack, Files Contempt Order](https://thehackernews.com/2026/06/meta-blocks-nso-groups-new-whatsapp.html)
- [WhatsApp says it disrupted new NSO spyware phishing attacks](https://bleepingcomputer.com/news/security/whatsapp-says-it-disrupted-new-nso-spyware-phishing-attacks)
- [WhatsApp takes NSO Group back to court for violating its spyware ban](https://ppc.land/whatsapp-takes-nso-group-back-to-court-for-violating-its-spyware-ban/)
- [US court blocks spyware vendor NSO Group from targeting WhatsApp users](https://cyberinsider.com/us-court-blocks-spyware-vendor-nso-group-from-targeting-whatsapp-users/)
- [US court bans Israeli spyware company NSO from targeting WhatsApp after Meta lawsuit](https://malaymail.com/news/world/2025/10/19/us-court-bans-israeli-spyware-company-nso-from-targeting-whatsapp-after-meta-lawsuit/195133)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3914