Judge rejects WhatsApp bid to hold NSO Group in contempt over new targeting

A federal judge in Northern California has denied WhatsApp's request to hold Israeli spyware maker NSO Group in contempt for allegedly violating a court injunction, according to The Record. Judge Phyllis Hamilton ruled on Friday that WhatsApp had not shown with "clear and convincing evidence" that NSO breached the order, a decision that highlights how difficult it can be for platforms to prove spyware abuse without exposing their own detection methods.

What happened

According to The Record, WhatsApp filed its motion in June, alleging that NSO had violated the injunction by carrying out spearphishing attacks against individuals. Hamilton had issued the injunction against NSO in 2025 and fined the company $4.4 million, after agreeing with WhatsApp that NSO had misused the messaging app's infrastructure to target users and, in some cases, infect their devices with spyware.

The original case centered on NSO's Pegasus zero-click spyware, which The Record says was deployed against about 1,400 WhatsApp users in 2019.

Why the court said the evidence fell short

WhatsApp relied solely on a declaration from Andrew Blaich, a security engineer investigator on Meta's threat intelligence team, The Record reported. Blaich said he had identified 23 new WhatsApp accounts carrying technical and behavioral signatures previously linked to NSO testing, including registration patterns, device information and connections to known NSO-controlled infrastructure.

However, WhatsApp declined to explain in detail how it found this activity, arguing that disclosing its methods would make it harder to counter spyware companies in the future. In her ruling, Hamilton wrote that the plaintiffs had taken a calculated risk by limiting the detail in their supporting evidence, according to the report.

Reaction

Natalia Krapiva, senior tech counsel at digital rights group Access Now, criticized the decision, The Record said. She argued that requiring WhatsApp to publicly reveal its detection techniques could benefit NSO, foreign intelligence services, exploit developers and criminals, and that such a standard would lead to "complete impunity for the spyware industry." WhatsApp and NSO did not immediately respond to requests for comment, according to the publication.

Why it matters

The WhatsApp case has been one of the most closely watched legal efforts to hold a commercial spyware vendor accountable. The Record noted that Apple dropped its own lawsuit against NSO in September 2024, saying the case risked exposing "vital security information", the same tension that shaped this ruling. The decision suggests that platforms seeking to enforce court orders against spyware makers may face a hard choice between protecting their detection capabilities and meeting the evidentiary bar for contempt.

The ruling does not lift the existing injunction against NSO. For organizations and high-risk users, the case is a reminder that legal action alone has not stopped spyware targeting, and that measures such as keeping devices updated, enabling platform protections like Apple's Lockdown Mode, and treating unsolicited links with caution remain important.