Notorious Spyware Provider Faces $167 Million Fine for Hacking WhatsApp Users
A significant legal victory has been handed down in the ongoing battle over digital privacy and surveillance. A U.S. federal jury has ruled against NSO Group, an Israeli firm known globally for its surveillance software, ordering the company to pay $167 million in damages to WhatsApp. The case stems from a lawsuit filed by the Meta-owned messaging service in 2019, which accused NSO Group of attempting to hack into the accounts of over 1,400 of its users.
NSO Group has long been at the center of international controversy for developing Pegasus, a sophisticated spyware tool that can infiltrate smartphones without any user interaction—so-called zero-click attacks. Victims do not need to click a link or download a file; simply receiving a message can be enough to compromise their device. This makes Pegasus particularly dangerous, and it has reportedly been used to surveil journalists, political dissidents, activists, and even government officials around the world.
In the lawsuit, WhatsApp alleged that NSO Group exploited a security vulnerability in the messaging platform to install Pegasus on the phones of targeted individuals. After years of litigation, the jury found NSO acted with clear malicious intent, a judgment that not only results in a massive financial penalty but could also set a powerful precedent for future cases involving spyware misuse.
WhatsApp celebrated the court’s decision, stating that this marks the first major courtroom success against a spyware developer engaged in unlawful surveillance. According to WhatsApp, this victory sends a strong message to spyware vendors around the globe: such behavior will not be tolerated, and there will be real consequences for targeting users of American tech platforms.
Meta and WhatsApp emphasized that this ruling is about protecting users and reinforcing the importance of secure communication tools. In their statement, they called the decision a crucial milestone in the global effort to fight spyware abuse, especially attacks aimed at individuals who rely on encrypted platforms to communicate safely—such as journalists, dissidents, and at-risk communities.
Despite the court’s ruling, NSO Group has not backed down. The company stated that it plans to pursue additional legal avenues, including an appeal. It defended its operations by asserting that its surveillance tools serve legitimate national security purposes and are used by government agencies to combat serious crimes and terrorism. According to NSO, its products have helped law enforcement prevent attacks and save lives, including within the U.S., although none of that information was apparently allowed into evidence during the trial.
The financial penalty could have broader implications beyond this one case. Experts believe the ruling may damage NSO’s reputation further and deter governments from engaging with the company in the future. Citizen Lab, an organization that researches digital threats, pointed out that the trial exposed internal practices at NSO Group that could make potential clients more hesitant to align with them.
WhatsApp also raised further concerns about NSO’s capabilities, referencing trial documents that revealed the firm continues to invest heavily in developing malware capable of penetrating modern smartphone defenses. According to the messaging platform, NSO allocates tens of millions of dollars each year to maintain its spyware’s compatibility with popular operating systems, browsers, and communication apps—keeping it an ongoing threat to both Android and iOS users.
In light of the ruling, WhatsApp announced plans to direct a portion of the damages toward organizations focused on digital rights and online security. These donations are intended to help support global efforts to defend individuals and institutions against invasive surveillance technologies. WhatsApp also said it intends to seek a permanent court order that would bar NSO Group from targeting its users in the future.
This case represents a critical moment in the broader conversation around surveillance, cybersecurity, and digital rights. With the tide beginning to turn legally against companies profiting from spyware, tech firms and privacy advocates are watching closely to see if this ruling sparks more aggressive regulation and enforcement in the fight for online safety.
