IC Technology & Surveillance — 2026-06-10

WhatsApp Disrupts NSO Group Pegasus Spyware Campaign Targeting Users in Jordan and Lebanon

BLUFWhatsApp's contempt motion will likely produce a federal ruling by late 2026 that establishes whether U.S. injunctions can meaningfully constrain foreign commercial spyware vendors.

WhatsApp disrupted spear-phishing attempts targeting fewer than 10 users in Jordan and Lebanon, with a Meta spokesperson reporting no successful device compromises 1. Attackers attempted to redirect users to external websites via malicious links and created staging accounts and groups on the platform, all of which WhatsApp has since disabled 123. WhatsApp attributed the campaign to NSO Group based on technical similarities to previously documented one-click phishing operations tied to the firm and filed a federal contempt motion alleging NSO violated the permanent injunction issued in October 2025 that bars it from targeting WhatsApp and its users 123. Three malicious domains were published as indicators of compromise: ikhwancast[.]com, ghazacast[.]com, and fr24cast[.]com, all linked to NSO-associated phishing infrastructure 1.

Analysis
The contempt motion rests on documented post-injunction conduct: IOC domains linked to NSO infrastructure and staging accounts created on WhatsApp after October 2025. NSO's prior development of new exploit vectors, including "Erised" and "Heaven," during active litigation forecloses a credible good-faith defense at the contempt hearing. A contempt finding by December 31, 2026 is likely. Moderate confidence reflects the strength of the technical record, offset by judicial scheduling and NSO's active appeal of the underlying damages award. NSO's defense will argue a rogue operator rather than company-directed conduct, a framing that, if credited, places the campaign outside the injunction's scope. A contempt finding anchors the Commerce Department's blocklist designation. Its absence removes the most actionable lever U.S. policymakers hold and strengthens NSO's delisting case.
4 sources
  1. WhatsApp Disrupts NSO-Linked Cyberattack Targeting Users with Pegasus Spyware - Cyber Security News
  2. WhatsApp says it caught new spyware attacks linked to NSO Group in violation of court order - TechCrunch
  3. WhatsApp Catches Spyware Firm NSO Defying No-Hacking Court Order - SecurityWeek
  4. Fighting Spyware: An Update From WhatsApp - Meta Newsroom

View in full brief →

UNCLASSIFIED // OPEN SOURCE