NSO Group Fined $168 Million for WhatsApp Pegasus Spyware Hack
This digest was compiled by AI from multiple sources — links to the originals are below.
A California federal jury ordered NSO Group to pay $168 million in damages for hacking about 1,400 WhatsApp users with Pegasus spyware. The verdict, delivered on May 6, marks the first time the Israeli spyware vendor has been forced to pay for its abuses. The decision follows a six-year legal battle initiated by Meta after detecting the intrusion in 2019.
The Verdict
A California federal jury on May 6 ordered NSO Group to pay $167.254 million in punitive damages and $444,719 in compensatory damages to Meta. The ruling found the Israeli spyware vendor liable for hacking into approximately 1,400 WhatsApp users’ devices across 51 countries. The verdict marks the first time NSO Group has been forced to pay damages for its Pegasus spyware, which has been used to target activists, journalists, and diplomats.
Zero-Click Exploit
NSO Group’s Pegasus is a zero-click spyware that compromised devices without user interaction, exploiting a critical WhatsApp voice calling vulnerability (CVE-2019-3568, CVSS 9.8). The targeting campaign impacted 456 individuals in Mexico, 100 in India, 82 in Bahrain, 69 in Morocco, and 58 in Pakistan. Meta detected the intrusion in May 2019 and collaborated with the University of Toronto’s Citizen Lab to alert targeted users.
Six Years of Litigation
Meta filed suit against NSO Group in October 2019, sparking a legal battle that saw support from technology companies, NGOs, and human rights groups. In January 2025, a US District Court judge ruled NSO had violated federal and state hacking laws and breached WhatsApp’s terms, leaving only damages for the jury. The case withstood appeals, including a denied hearing by the US Supreme Court, before returning to district court for the penalty phase.
1 source
Time · lag behind first