WhatsApp Wins Its Spyware Case But Loses the Contempt Fight Against NSO Group
A federal judge said Meta's evidence against NSO Group wasn't detailed enough to prove the spyware maker broke its court-ordered injunction, even as privacy advocates warn that more disclosure could backfire.
WhatsApp spent years building a case against NSO Group, the Israeli company behind the Pegasus spyware, and won. Then it tried to prove NSO was still breaking the rules a judge had laid down, and lost that round.
Judge Phyllis Hamilton of the Northern District of California ruled Friday that WhatsApp failed to show, with sufficiently clear and convincing evidence, that NSO Group violated a 2025 injunction barring the company from using WhatsApp's infrastructure to attack the app's users. The decision, reported by The Record, came in response to a contempt motion WhatsApp filed in June, accusing NSO of running new spearphishing attacks against its customers despite the court order.
It's a strange turn in a case WhatsApp, owned by Meta, otherwise won decisively. Hamilton had already found that NSO improperly exploited WhatsApp's systems to target and in some cases infect devices belonging to roughly 1,400 users back in 2019, using the company's Pegasus spyware — a tool known for "zero-click" attacks that can compromise a phone without the victim clicking anything. That earlier ruling came with a $4.4 million fine and the injunction now at the center of this dispute.
This time, though, the evidence WhatsApp brought wasn't enough. The company relied on a declaration from Andrew Blaich, a security engineer on Meta's threat intelligence team, who said he had identified 23 new WhatsApp accounts showing what he described as "technical and behavioral signatures that Meta has previously associated with NSO testing," including registration patterns, device data, and links to infrastructure previously tied to NSO. Hamilton quoted that language directly in her opinion, but found it fell short of proving the injunction had actually been violated.
Why wasn't it enough? Hamilton put the blame squarely on WhatsApp's own strategy. The company chose to keep the technical detail behind Blaich's findings limited, out of concern that spelling out its detection methods in court could hand spyware makers a roadmap for evading detection in the future. Hamilton didn't buy that tradeoff. "In the court's view, plaintiffs took a calculated risk in choosing to limit the level of detail in their supporting evidence," she wrote.
A familiar bind for platforms fighting spyware
WhatsApp isn't the first company to run into this wall. Apple dropped its own lawsuit against NSO Group in September 2024, saying at the time that pressing forward risked exposing "vital security information." The pattern suggests a genuine structural problem: the same evidence that proves a spyware maker is still operating is often the evidence that shows exactly how a platform catches them doing it.
That's the tension digital rights advocates pointed to after Friday's ruling. Natalia Krapiva, senior tech counsel at Access Now, told The Record that judges handling spyware cases need to weigh what public disclosure of detection methods would actually hand to the other side. In her view, forcing companies like WhatsApp to lay out their research and detection techniques in open court wouldn't just help NSO Group. It could benefit foreign intelligence services, exploit developers, and criminals who'd love a detailed map of how sophisticated spyware gets caught and how platforms monitor for it.
Krapiva went further, arguing that if courts keep requiring this level of disclosure to hold spyware vendors accountable, the practical effect is close to letting the industry off the hook entirely. Spyware companies get to keep operating with minimal risk of enforcement, because the companies trying to police them can't prove violations without giving away the playbook that lets them detect abuse in the first place.
What happens now
Neither WhatsApp nor NSO Group responded to requests for comment on the ruling, according to The Record. For now, the injunction and the $4.4 million judgment from the original case still stand — NSO lost that fight. But the contempt ruling means WhatsApp's accusations of fresh spearphishing attempts go unproven in the court's eyes, at least based on the evidence presented so far.
The bigger question is what this means for the next company that tries to haul a spyware maker back into court for violating an injunction. If detailed technical disclosure is the price of proving a violation, and that disclosure carries its own security cost, companies like WhatsApp may keep facing the same choice Hamilton flagged: hold back the specifics and risk losing the contempt fight, or lay bare detection methods and risk making the next attack easier to pull off.
