The spyware firm is accused of spear phishing users in Jordan and Lebanon after a federal injunction barred it from doing so, putting a test of enforcement reach against foreign controlled vendors directly before a US judge.
Meta has asked a US federal court to hold NSO Group in contempt, alleging the spyware vendor secretly targeted WhatsApp users in Jordan and Lebanon in violation of a permanent injunction that already bars the company from such activity. The motion, described in a Guardian report on Meta's filing, turns a years-old legal dispute into a fresh test of whether American court orders can actually constrain a foreign-controlled commercial-spyware operation.
According to Meta, WhatsApp "caught and disrupted" spear-phishing attempts by NSO aimed at a small number of users in Jordan and Lebanon. Meta also says NSO used "test accounts and groups" on the platform as part of the activity. The contempt motion argues that the campaign violates a permanent injunction Meta won against NSO in 2019, after WhatsApp sued the Israeli spyware maker for exploiting a vulnerability in its messaging app to deploy Pegasus, software capable of harvesting messages, photos, calls, and other data from infected phones.
That earlier case ended in 2024 with a damages award that, as the Guardian notes, was reduced from $167 million to roughly $4 million on First Amendment and other grounds. The court also entered a permanent injunction barring NSO from targeting WhatsApp users. The new filing asks the court to treat the alleged spear-phishing as a direct violation of that order.
John Scott Railton of Citizen Lab, who has tracked NSO's spyware for years, framed the alleged conduct in starker terms. As quoted in the Guardian's report, Railton called the alleged activity "hubris" and questioned whether NSO believes it can avoid consequences for violating a US federal injunction. The contempt motion will now give a judge a chance to answer that question.
The legal posture is unusual in one respect. NSO Group, founded in Israel, has been under US ownership since last year, the Guardian's report notes, after a deal led by Hollywood producer Robert Simonds that gave an American investment group controlling ownership. NSO is also on the US Commerce Department's entity list, which restricts its access to American technology. The contempt motion therefore lands on a company that is simultaneously barred by a US court, sanctioned by a US agency, and trying to position itself for a return to the American market, a set of contradictions that makes the case a useful lens for the larger question of whether US legal tools work against foreign-controlled commercial-spyware vendors in practice.
The honest answer is that they sometimes do, and sometimes don't. The 2019 injunction did not stop NSO from allegedly continuing to use WhatsApp as a delivery channel, if Meta's new allegations are accurate. The damages award, originally large enough to function as a deterrent, was cut by roughly two orders of magnitude. The blacklist constrains NSO's supply chain but has not ended its operations. Each lever pulled separately has produced a partial result. The contempt motion pulls them together by asking a court to treat a specific alleged act as a violation of its own order, on the record, with the plaintiff that has already proven the underlying harm.
What to watch next is whether NSO responds on the merits, and whether it does so in the US filing rather than in Israeli or other foreign forums where US judgments have less reach. The Guardian's reporting notes that NSO did not immediately respond. A no-comment posture would be consistent with a company betting that legal geography still protects it. A substantive denial, by contrast, would be the first time NSO has been forced to defend a specific act under oath in the very court that already told it to stop.
The case also has implications beyond NSO. Other commercial-spyware vendors operate in similar legal territory: foreign-controlled, foreign-deployed, and increasingly the subject of US sanctions and European export investigations. If Meta's contempt motion results in meaningful sanctions, it would give plaintiffs a tool against vendors that have so far treated US injunctions as advisory. If it results only in another round of filings, it would confirm what Railton suggested in the Guardian's account, that some vendors believe they can absorb the cost of violating US court orders and continue doing business.
The contempt motion does not, on its own, change NSO's behavior. What it does is put a specific allegation, a specific injunction, and a specific question of enforcement reach in front of a US judge, in a US case, with a plaintiff that has already prevailed once. The next meaningful test is not whether the contempt motion is filed. It is what the court does with it.