Meta blocks NSO-linked WhatsApp phishing, files contempt order

Meta announced Monday that it detected and blocked spear-phishing attempts tied to NSO Group on WhatsApp. The company removed test accounts and groups, took down linked domains and filed a federal contempt order alleging NSO violated a permanent court injunction that barred it from targeting WhatsApp and its users.

Meta described the activity as messages designed to trick recipients into clicking malicious links that redirected to external websites, a method similar to earlier one-click phishing campaigns attributed to NSO. The company identified domains associated with the operation as fr24cast.com, ghazacast.com and ikhwancast.com and said the test accounts and groups were removed after detection.

The contempt filing was submitted in federal court. In related litigation last year a U.S. court ordered about $168 million in damages after finding NSO had exploited WhatsApp servers to deploy Pegasus spyware against more than 1,400 individuals worldwide. In 2021 the U.S. Commerce Department added NSO to a blocklist for activities it said were contrary to U.S. national security or foreign policy interests.

Meta said WhatsApp continues to protect users’ personal messages and calls with default end-to-end encryption. The company urged people to keep apps and devices up to date and to report suspicious activity so it can investigate and take action.

Users who believe they face elevated risk were told to enable WhatsApp’s strict account settings to harden their accounts. Those settings turn on two-step verification, disable link previews, limit profile details such as last seen, online status and profile photo to contacts only or a pre-established list, and restrict who can add the account to groups. “Strict account settings are an advanced security feature that turns on privacy and security controls to help protect accounts from sophisticated cyber attacks,” Meta’s help document states.

Meta did not disclose whether any WhatsApp users were successfully compromised in the recent activity it blocked. NSO Group has previously denied wrongdoing in public responses to legal actions and sanctions.