The disrupted attacks

WhatsApp's investigation revealed two distinct violations of the court order:

• Spear-phishing campaigns: NSO-linked attackers attempted to trick users into clicking malicious links that redirected to external websites outside of WhatsApp's control. These campaigns closely mirrored the "1-click phishing" tactics NSO has used in past operations to deploy its Pegasus spyware .
• Unauthorized test accounts: Meta also caught NSO creating test accounts and groups on WhatsApp to test its surveillance products, activity the company says is a direct violation of the permanent injunction .

These actions represent a brazen defiance of a court order that explicitly prohibits NSO from "ever again" accessing or attempting to access WhatsApp's platform .

The legal battle: a six-year escalation

The contempt filing is the latest chapter in a legal war that began in 2019 when WhatsApp first sued NSO for exploiting a vulnerability in its audio-calling feature to install Pegasus spyware on roughly 1,400 users' devices, targeting journalists, human rights activists, and political dissidents .

Key milestones in the case:

• October 2019: WhatsApp files suit in the U.S. District Court for the Northern District of California, accusing NSO of violating the Computer Fraud and Abuse Act and California state hacking laws .
• December 2024: Judge Phyllis Hamilton grants summary judgment, finding NSO liable for hacking and ruling the company violated both federal and state anti-hacking statutes .
• May 2025: A federal jury orders NSO to pay approximately $168 million in damages—$167.25 million in punitive damages and $444,719 in compensatory damages—and issues a permanent injunction barring NSO from targeting WhatsApp . The verdict was hailed by Amnesty International as a "momentous win" and by Meta as "a critical deterrent to this malicious industry" .
• June 2026: Meta files the contempt motion, alleging NSO has already violated that injunction with new attacks .

Why the contempt motion matters

A contempt motion is a significant escalation because it doesn't start from scratch. Instead, it asks the same court that issued the injunction to enforce it with sanctions. If granted, NSO could face fines, asset seizures, or other coercive penalties designed to compel compliance .

Legally, the motion signals that Meta is now pursuing a zero-tolerance enforcement strategy. Rather than waiting for a new pattern of attacks to build another multi-year case, the company is moving immediately—an approach that could reshape how platforms respond to repeat offenders from the surveillance industry.

The broader spyware threat

NSO Group has been blacklisted by the U.S. government for activities "contrary to the national security or foreign policy interests" of the United States . Despite this designation and the 2025 verdict, the company's continued activity against WhatsApp underscores a stubborn reality: legal victories alone have not stopped the commercial spyware industry.

Meta's enforcement push is part of a wider platform crackdown. In early 2025, WhatsApp alerted roughly 90 journalists and civil society members about a separate zero-click attack campaign linked to another Israeli spyware firm, Paragon Solutions . That campaign, which WhatsApp disrupted in December 2024, reportedly used malicious PDFs sent in group chats to compromise devices without any user interaction.

These cases collectively reveal an industry that has not been deterred by a single landmark verdict. The contempt motion is Meta's clearest statement yet that it intends to use every legal tool available—not just to win damages, but to enforce the permanent restrictions courts have already imposed on spyware vendors .

The disrupted attacks

WhatsApp's investigation revealed two distinct violations of the court order:

• Spear-phishing campaigns: NSO-linked attackers attempted to trick users into clicking malicious links that redirected to external websites outside of WhatsApp's control. These campaigns closely mirrored the "1-click phishing" tactics NSO has used in past operations to deploy its Pegasus spyware .
• Unauthorized test accounts: Meta also caught NSO creating test accounts and groups on WhatsApp to test its surveillance products, activity the company says is a direct violation of the permanent injunction .

These actions represent a brazen defiance of a court order that explicitly prohibits NSO from "ever again" accessing or attempting to access WhatsApp's platform .

The legal battle: a six-year escalation

The contempt filing is the latest chapter in a legal war that began in 2019 when WhatsApp first sued NSO for exploiting a vulnerability in its audio-calling feature to install Pegasus spyware on roughly 1,400 users' devices, targeting journalists, human rights activists, and political dissidents .

Key milestones in the case:

• October 2019: WhatsApp files suit in the U.S. District Court for the Northern District of California, accusing NSO of violating the Computer Fraud and Abuse Act and California state hacking laws .
• December 2024: Judge Phyllis Hamilton grants summary judgment, finding NSO liable for hacking and ruling the company violated both federal and state anti-hacking statutes .
• May 2025: A federal jury orders NSO to pay approximately $168 million in damages—$167.25 million in punitive damages and $444,719 in compensatory damages—and issues a permanent injunction barring NSO from targeting WhatsApp . The verdict was hailed by Amnesty International as a "momentous win" and by Meta as "a critical deterrent to this malicious industry" .
• June 2026: Meta files the contempt motion, alleging NSO has already violated that injunction with new attacks .

Why the contempt motion matters

A contempt motion is a significant escalation because it doesn't start from scratch. Instead, it asks the same court that issued the injunction to enforce it with sanctions. If granted, NSO could face fines, asset seizures, or other coercive penalties designed to compel compliance .

Legally, the motion signals that Meta is now pursuing a zero-tolerance enforcement strategy. Rather than waiting for a new pattern of attacks to build another multi-year case, the company is moving immediately—an approach that could reshape how platforms respond to repeat offenders from the surveillance industry.

The broader spyware threat

NSO Group has been blacklisted by the U.S. government for activities "contrary to the national security or foreign policy interests" of the United States . Despite this designation and the 2025 verdict, the company's continued activity against WhatsApp underscores a stubborn reality: legal victories alone have not stopped the commercial spyware industry.

Meta's enforcement push is part of a wider platform crackdown. In early 2025, WhatsApp alerted roughly 90 journalists and civil society members about a separate zero-click attack campaign linked to another Israeli spyware firm, Paragon Solutions . That campaign, which WhatsApp disrupted in December 2024, reportedly used malicious PDFs sent in group chats to compromise devices without any user interaction.

These cases collectively reveal an industry that has not been deterred by a single landmark verdict. The contempt motion is Meta's clearest statement yet that it intends to use every legal tool available—not just to win damages, but to enforce the permanent restrictions courts have already imposed on spyware vendors .