WhatsApp disrupts new NSO spyware phishing campaigns

WhatsApp has detected and stopped spear-phishing campaigns allegedly conducted by the NSO Group after investigating user reports of social engineering attacks.

WhatsApp links the attacks to the sanctioned NSO Group. The NSO Group is an Israeli commercial spyware vendor known for its advanced Pegasus tool that has been deployed against politicians, activists, journalists, academics, and other high-interest individuals. The firm has been on the U.S. sanctioned entities list since November 2021 due to supplying to foreign governments software products that were used against people and organizations in the U.S. Tools from NSO were also used by regimes considered repressive that targeted dissidents outside their borders.

Meta previously secured a court victory against NSO. WhatsApp's parent company Meta has fought NSO Group in U.S. courts, securing a permanent injunction against it in 2025, a declaration of liability for 1,400 infections, and an associated $167,000,000 fine. According to Meta’s latest announcement, these prior rulings have not deterred NSO Group's activities targeting certain WhatsApp users.

The latest attacks used social engineering and test accounts. It is alleged that the attacker attempted to lure targets into clicking on malicious links that redirected to external websites, resembling previously documented one-click phishing campaigns associated with NSO. Meta says it successfully disrupted NSO-linked social engineering attempts after investigating user reports. They tried to trick people into clicking on malicious links to drive them to external websites outside of WhatsApp, similar to previously reported 1-click phishing campaigns linked to NSO. Meta also caught them creating test accounts and groups on WhatsApp, which it took down.

Meta lists domains tied to the campaigns. The tech giant listed the following domains as indicators of compromise for the attacks it detected: ikhwancast[.]com, ghazacast[.]com, and fr24cast[.]com. Meta argues that this activity violates the 2025 court order that issued a permanent injunction against NSO Group, preventing the spyware vendor from targeting WhatsApp or its users.

Meta highlights ongoing national security risks. Meta's announcement highlights the threat that NSO Group poses to national security, citing the spyware company’s CEO statement in court about seeking access vectors beyond WhatsApp, and reminding that the firm has been sanctioned in the U.S. WhatsApp noted that end-to-end encryption effectively protects users’ messages and calls from Pegasus and other spyware but called users to update their apps and operating systems for optimal protection. To block commercial spyware attacks or strengthen defenses on mobile, Android users can also activate Advanced Protection, while iOS users can enable Lockdown Mode, both of which are specifically designed to reduce the attack surface and data exposure to spyware.