A US federal court has ruled that Israeli company NSO Group must pay $168 million in damages to Meta ’s WhatsApp platform . The decision comes four months after a verdict found that NSO violated US law by exploiting WhatsApp servers to install Pegasus spyware , which was used to monitor more than 1,400 users worldwide .
The case began in 2019, when WhatsApp filed a lawsuit against NSO Group, accusing it of using its platform to launch espionage attacks against journalists, activists, and political opponents of authoritarian regimes.
According to court documents, the majority of the attacks targeted Mexican (456 cases), followed by India (100 victims), Bahrain (82), Morocco (69) and Pakistan (58). In total, the victims came from 51 different countries, revealing the international scope of the Pegasus spyware surveillance campaign.
See also: Android spyware targets Russian military
The cyberattacks were based on a critical zero-day vulnerability in the application's voice calling functionality (CVE-2019-3568 – CVSS score 9.8/10). This vulnerability allowed Pegasus to be silently installed without user consent or action.
In December 2024, Judge Phyllis J. Hamilton reported that malware was distributed through WhatsApp servers in California, on at least 43 occasions, in May 2019.
In an official statement on Platform X, Will Cathcart, head of WhatsApp, emphasized the importance of the court decision, saying that the case set a legal precedent as it explicitly recognized the violation of both state and federal US law.
This verdict sends a strong message to the spyware industry, showing that they must stop the illegal practices that threaten businesses and users worldwide.
Will Cathcart said WhatsApp's next move would be to seek a court order to prevent NSO Group from attacking the platform again. He also announced that the company plans to provide financial support to international organizations that defend digital rights and privacy, especially those working to protect citizens from such technological violations.
See also: Paragon Spyware: Which governments use it – Victims in Greece too
In addition to the $167.25 million punitive damages, the court ruling provides for an additional $444,719 in damages to cover the technical resources WhatsApp spent to address and repel the attack.
This development is considered particularly significant for those who defend privacy and human rights, as for years they accused NSO Group of marketing the Pegasus spyware to governments and agencies that used it against activists, journalists and members of civil society.
Despite NSO's attempts to deny liability, claiming that it does not control the use of the software by its customers, Judge Phyllis Hamilton rejected the argument, noting that it is not possible, on the one hand, to claim the purpose of combating terrorism and child exploitation, and on the other hand to declare complete ignorance of how the software is used by its users.
A Meta spokesperson emphasized that NSO Group has publicly admitted that it invests tens of millions of dollars each year in developing techniques that facilitate the hacking of devices — through messaging apps, browsers, and operating systems — and that Pegasus remains capable of penetrating modern devices running iOS and Android.
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
NSO's reaction and Apple's withdrawal from the legal dispute
In a statement released to Courthouse News and POLITICO, NSO Group defended its actions, arguing that its technology is instrumental in preventing serious criminal acts and terrorist attacks. The company made it clear that it intends to exhaust all legal means to defend its position in courtrooms. It is recalled that since 2021 NSO has been subject to sanctions by the US government, accused of engaging in harmful digital activities.
See also: North Korean hackers “uploaded” spyware to Google Play
It is worth noting that Apple had also filed a lawsuit against NSO Group on similar grounds. However, in September 2024, it decided to withdraw its legal action, citing concerns that continuing the case might expose confidential information about the internal operations and security architecture of its products.
However, the compensation decision is a landmark in the field of digital security and human rights. The ruling against NSO Group shows that courts – at least in the US – are now willing to impose serious penalties on companies that develop and market surveillance software without adequate controls over where and how it is used.
NSO’s excuse that its technology is used to combat terrorism is not enough when there is evidence that it has been used against journalists, activists and other vulnerable groups. The fact that Apple dropped its own lawsuit on security grounds is understandable, but also revealing of how difficult the balance is between legal transparency and protecting critical information.
Overall, the decision reinforces the debate on the need for a regulatory framework around cyberespionage tools and puts a "brake" on the hitherto uncontrolled actions of such companies.
Source: thehackernews.com
