IC Technology — 2026-06-19

WhatsApp Seeks Contempt Ruling Against NSO Group for Renewed Pegasus Spyware Targeting in Violation of Court Order

BLUFHamilton will likely find NSO in contempt by year-end, and the resulting compliance framework could functionally constrain Pegasus operations beyond what the original injunction achieved.

WhatsApp filed a contempt motion before US District Judge Phyllis Hamilton on June 8, alleging NSO Group violated the permanent injunction in effect since January 28 "almost immediately" after it took effect 12. In a supporting court declaration, Meta security engineer Andrew Blaich identified at least 23 NSO-linked WhatsApp accounts and 34 groups created between January 28 and early June, including more than 20 designated testing groups spanning 13 countries with naming conventions matching NSO's previously documented internal operations 1. Meta attributed two spear-phishing campaigns, one from February 3 to 7 and a second from April 13 to 19, to NSO with "high confidence," citing one-click malicious URLs using domains tied to Pegasus delivery infrastructure 12. The filing requests escalating daily fines and sworn compliance certifications from NSO's chief executive and executive chairman before any sanctions can be lifted 1.

Analysis
Country-specific test group naming conventions spanning 13 countries and infrastructure continuity across both delivery campaigns place NSO's January CEO compliance declaration directly in conflict with documented post-injunction operations and preemptively dismantle any routing-through-customers defense. Hamilton is likely to find NSO in contempt by December 31, 2026. Moderate confidence reflects that the attribution rests entirely on Meta's sworn filings, with no independent technical corroboration of the domain-to-NSO linkages. The Blaich declaration surfaces detail absent from prior reporting: country-keyed test group names and an NSO-logo desk mat photograph. NSO may counter that customers operating NSO-provided infrastructure independently generated the post-injunction activity, placing prohibited conduct outside NSO's direct control. A contempt finding hands Commerce Department reviewers a federal court record of post-sanction violations when evaluating NSO's Entity List petition.
4 sources
  1. Meta Says NSO Continued Pegasus Operations Despite WhatsApp Injunction, Seeks Contempt Ruling - The Wire
  2. Meta accuses NSO Group of breaching WhatsApp court order - The Hill
  3. WhatsApp Accuses NSO of Fresh Pegasus Targeting - Citizen Lab
  4. WhatsApp says it caught new spyware attacks linked to NSO Group in violation of court order - TechCrunch

View in full brief →

UNCLASSIFIED // OPEN SOURCE