Meta’s Contempt Motion: What the New Clash Is About
Meta’s contempt motion against NSO Group centers on fresh NSO Group WhatsApp phishing activity that allegedly violates a permanent court injunction, showing how Pegasus spyware attacks and related lures continue to threaten users even after headline legal victories. Meta said it recently detected and blocked new spear-phishing attempts tied to the surveillance vendor, which tried to trick targets into clicking malicious links that led to external websites, mirroring earlier “1-click” campaigns. The company also removed NSO-created test accounts and groups on WhatsApp. Domains linked to the attempts included fr24cast[.]com, ghazacast[.]com, and ikhwancast[.]com, indicating a renewed infrastructure for WhatsApp phishing campaigns rather than a one-off incident. By asking a federal court to hold NSO in contempt, Meta is moving from winning a judgment on paper to forcing compliance in practice.
From Pegasus Lawsuit to Alleged Court Injunction Violations
The contempt motion grows out of Meta’s earlier lawsuit over Pegasus spyware attacks delivered through WhatsApp. A U.S. court previously ruled that NSO had violated domestic laws by using WhatsApp servers to deploy Pegasus against roughly 1,400 individuals worldwide, and Meta says this resulted in around USD 168 million (approx. RM772,800,000) in monetary damages in one account of the case. Another report notes that while punitive damages were later reduced to USD 4 million (approx. RM18,400,000), the permanent injunction blocking NSO from targeting WhatsApp or its users remained in force. Meta now argues that the newly detected phishing attempts amount to court injunction violations, turning an already landmark case into a test of whether surveillance-for-hire firms can be compelled to change behavior, not only pay penalties.
A Pattern of Defiance by NSO Group and the Spyware Industry
Meta portrays the new NSO Group WhatsApp activity as part of a broader pattern of defiance. According to coverage of the case, NSO has already been placed on a U.S. government blocklist for conduct judged “contrary to the national security or foreign policy interests” of the United States, yet WhatsApp continues to detect attempts to reach its users. Investigations by Amnesty International, Citizen Lab, and others have linked Pegasus spyware attacks to journalists, activists, opposition politicians, lawyers, and human rights defenders across multiple regions. Industry reporting describes NSO as one node in an export-oriented surveillance sector that sells “battle-tested” tools to governments eager to monitor dissent. In this context, Meta’s contempt motion is more than a private dispute: it is a challenge to a commercial spyware model that has treated prior lawsuits, sanctions, and reputational damage as manageable business costs.
Ongoing Risks for WhatsApp Users Despite Security and Rulings
For billions of WhatsApp users, Meta’s legal win and the platform’s default end-to-end encryption have not ended the threat. The latest NSO-linked WhatsApp phishing campaigns show that attackers can still use malicious links, social engineering, and 1-click techniques to compromise devices, even without breaking encryption itself. Meta stresses that users’ personal messages and calls remain protected, but warns that sophisticated actors are probing the broader ecosystem around the app. In response, WhatsApp encourages users at higher risk—such as people in sensitive roles—to enable stricter account settings: turn on two-step verification, disable link previews, and limit profile visibility (last seen, profile photo, About details, and profile links) to contacts only or similar privacy-focused options. These steps cannot end Pegasus spyware attacks, but they narrow the attack surface while courts decide how far they can go in enforcing orders against NSO.
