NSO Group Fined $168M for Targeting 1,400 WhatsApp Users With Pegasus Spyware
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2019-3568 | Buffer Overflow RCE in WhatsApp VoIP Stack via Crafted RTCP Packets A buffer overflow (CWE-122) in the VoIP telephony stack of WhatsApp allowed a remote attacker to achieve remote code execution on a target device by sending a specially crafted series of RTCP packets to the victim's phone number. Because the flaw resided in the call-handling stack of the core app, an attacker who could reach the target's phone number over the network could gain arbitrary code execution on the device. All WhatsApp users at the time of disclosure were potentially exposed, since the vulnerable component shipped in the mainstream Meta Platforms (then Facebook) product rather than an optional add-on. The vulnerability was added to CISA's Known Exploited Vulnerability catalog on 2022-04-19, indicating confirmed real-world exploitation, and its EPSS score of 39.2% (99th percentile) signals a high likelihood of continued exploitation; no public proof-of-concept is known. It was remediated in vendor updates issued in 2019 and is widely associated with targeted espionage use (notably Pegasus spyware deployments). Do: Update WhatsApp on all mobile devices to the latest vendor release, per the CISA KEV required action; inventory your mobile fleet for outdated 2019-era builds and verify current app versions. Prioritize high-value targets (executives, journalists, government personnel) given the vulnerability's confirmed in-the-wild exploitation in espionage campaigns. No public PoC is known, but the flaw is remotely exploitable via network packets to a phone number, so treat patching as urgent. | 9.8 | 30% | KEV |
| mass≈1.5–2 billion users (effectively the entire global WhatsApp user base at the time of disclosure) |
Full article572 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananMay 07, 2025Vulnerability / Spyware
A federal jury on Tuesday decided that NSO Group must pay Meta-owned WhatsApp WhatsApp approximately $168 million in monetary damages, more than four months after a federal judge ruled that the Israeli company violated U.S. laws by exploiting WhatsApp servers to deploy Pegasus spyware, targeting over 1,400 individuals globally.
WhatsApp originally filed the lawsuit against NSO Group in 2019, accusing the latter of using Pegasus to target journalists, human rights activists, and political dissidents.
Court documents released as part of the trial have revealed that 456 Mexicans were targeted during the campaign, followed by 100 victims in India, 82 in Bahrain, 69 in Morocco, and 58 in Pakistan. In total, individuals across 51 different countries were targeted.
The attacks leveraged a then zero-day vulnerability in WhatsApp's voice calling feature (CVE-2019-3568, CVSS score: 9.8) to trigger the deployment of the spyware.
In a ruling issued in December 2024, United States District Judge Phyllis J. Hamilton noted that Pegasus was sent through WhatsApp's California-based servers 43 times during the relevant time period in May 2019.
"Our case against spyware developer NSO made history when the court found that they broke both federal and state laws in the United States in December," Will Cathcart, head of WhatsApp at Meta, said in a statement on X.
"And the jury's verdict today to punish NSO is a critical deterrent to the spyware industry against their illegal acts aimed at American companies and our users worldwide."
Cathcart added the company's next step is to secure a court order to prevent NSO from ever targeting WhatsApp again, adding it will be making a donation to digital rights organizations that are working to defend people against such attacks across the world.
In addition to the $167,254,000 in punitive damages, the jury determined that NSO Group must pay WhatsApp $444,719 in compensatory damages for the significant efforts WhatsApp engineers made to block the attack vectors.
The development is a major victory for privacy advocates and human rights organizations, who have repeatedly called out NSO Group for licensing its potent surveillance software to customers for keeping tabs on members of civil society.
While NSO Group tried to evade liability by claiming that it does not have visibility into what its clients do with Pegasus, Judge Hamilton pointed out it cannot claim that "its intent is to help its clients fight terrorism and child exploitation, and on the other hand say that it has nothing to do with what its client does with the technology, other than advice and support."
"NSO was forced to admit that it spends tens of millions of dollars annually to develop malware installation methods including through instant messaging, browsers, and operating systems and that its spyware is capable of compromising iOS or Android devices to this day," Meta said.
In a statement shared with Courthouse News and POLITICO, NSO Group said its technology plays a crucial role in preventing serious crime and terrorism, and that it intends to pursue appropriate legal remedies. The company was sanctioned by the U.S. government in 2021 for engaging in "malicious cyber activities."
Apple, which filed a similar lawsuit against NSO Group, dropped it in September 2024, saying that continuing it could reveal sensitive details of its security program.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2025/05/nso-group-fined-168m-for-targeting-1400.html