A US federal judge has issued a permanent injunction against spyware firm NSO Group, prohibiting it from using its Pegasus tool to target WhatsApp users. The ruling stems from a 2019 lawsuit by Meta, WhatsApp's owner, which accused NSO of attempting to infect around 1,400 devices belonging to journalists, activists, and others. The decision requires NSO to delete any obtained data and highlights the harm to end-to-end encryption.
On October 17, 2025, US District Judge Phyllis J. Hamilton in the Northern District of California granted Meta's request for a permanent injunction in its long-running case against NSO Group. The lawsuit, filed in 2019, alleged that NSO used Pegasus spyware to surreptitiously target approximately 1,400 mobile phones, many owned by attorneys, journalists, human-rights activists, political dissidents, diplomats, and senior foreign officials. As part of the operation, NSO created fake WhatsApp accounts and attacked Meta's infrastructure to defeat the app's end-to-end encryption, powered by the open-source Signal Protocol.
The ruling mandates that NSO permanently stop targeting WhatsApp users, infecting their devices, or intercepting messages. It also orders the deletion of any data NSO acquired from these efforts. Judge Hamilton emphasized the business harm to Meta, writing: “In the court’s view, any business that deals with users’ personal information, and that invests resources into ways to encrypt that personal information, is harmed by the unauthorized access of that personal information—and it is more than just a reputational harm, it’s a business harm. Essentially, part of what companies such as Whatsapp are ‘selling’ is informational privacy, and any unauthorized access is an interference with that sale. Defendants’ conduct serves to defeat one of the purposes of the service being offered by plaintiffs, which constitutes direct harm.”
NSO had argued the injunction would force it out of business, as Pegasus is its flagship product. However, Hamilton ruled that the harm to Meta outweighed such concerns. The judge denied Meta's broader requests to bar NSO from targeting users of other Meta platforms like Facebook and Instagram, citing lack of evidence, and declined to include foreign governments, noting they were not parties to the suit.
In a statement, WhatsApp head Will Cathcart said: “Today’s ruling bans spyware maker NSO from ever targeting WhatsApp and our global users again. We applaud this decision that comes after six years of litigation to hold NSO accountable for targeting members of civil society. It sets an important precedent that there are serious consequences to attacking an American company.”
Hamilton reduced punitive damages from a jury's $167 million award to $4 million, applying the correct legal standard. Pegasus, known for zero-click exploits that bypass iOS and Android defenses without user interaction, is licensed by NSO only to vetted governments, though the case revealed abuses against dissidents and journalists. NSO did not respond to requests for comment.