TL;DR: Meta asked a federal court on June 8, 2026 to hold NSO Group in civil contempt for running fresh spear-phishing campaigns against WhatsApp users, more than seven months after US District Judge Phyllis Hamilton signed a permanent injunction barring the Israeli spyware vendor from doing exactly that.[1][2] WhatsApp says it caught NSO-linked accounts running 1-click phishing links and test infrastructure inside WhatsApp, then took the accounts and groups down.[1] The contempt motion is the third round of a case that started in 2019 when WhatsApp first sued NSO over the Pegasus exploit chain that hit roughly 1,400 phones.[3] NSO is still appealing the original 2025 injunction at the Ninth Circuit, where the Knight First Amendment Institute filed an amicus brief last month warning that allowing NSO to keep selling Pegasus would be "a profound threat to free expression and freedom of the press."[1]
- What WhatsApp caught: 1-click phishing links designed to lure users to malicious sites outside WhatsApp, plus NSO-controlled test accounts and groups inside WhatsApp that WhatsApp says it identified and removed. The attack pattern matches the 2019 exploit chain: get the user to click once, route them off-platform, install Pegasus on the device.[1]
- What Meta asked for: a contempt order against NSO in the Northern District of California case, the same court that issued the October 17, 2025 permanent injunction.5 Meta is not filing a separate new lawsuit; it is using the existing 2019 case to ask the court to punish NSO for ignoring the order it already has.[1][3]
- What NSO is doing in parallel: still appealing the underlying injunction at the Ninth Circuit after Judge Hamilton denied its motion to stay in late 2025. The contempt motion is now sitting on Judge Hamilton's docket while the appeal is pending. NSO told the appellate court that the injunction will "force NSO out of business" because it cannot legally serve Pegasus customers via WhatsApp's three-billion-user network.[4]
- Why this is the third round: the WhatsApp v. NSO litigation has now gone through three distinct legal stages since 2019. Round one: the original 2019 complaint over 1,400 infected phones. Round two: the May 2025 jury verdict ($167.25 million) and Judge Hamilton's October 2025 reduction to $4 million plus the permanent injunction. Round three: the June 2026 contempt motion, alleging NSO is treating the injunction as a suggestion.[3][4]
The 2019 case is back, and it is angry
The original WhatsApp v. NSO complaint was filed in October 2019, two years after Citizen Lab first documented Pegasus being used against journalists and human rights defenders, and a year after the Saudi Arabia-internal killing of Jamal Khashoggi drew public attention to NSO's client list. WhatsApp's theory of the case was unusually direct: NSO reverse-engineered the WhatsApp client, then routed exploit code through WhatsApp's call servers to install Pegasus on roughly 1,400 target phones in 2019 alone.[3]
Judge Hamilton's permanent injunction order quotes the technical finding in unusually blunt language: "The evidence showed that defendants reverse-engineered WhatsApp's code to create a modified version of the WhatsApp client application, which they then used to install their software on target users' devices via WhatsApp's servers." It also notes NSO "repeatedly re-designed their software to avoid detection and circumvent plaintiffs' security fixes," which is now the relevant sentence. WhatsApp is alleging NSO has done it again.[3]
What the June 8 contempt motion says
Meta's announcement, made through both an Ars Technica exclusive and a parallel statement on the WhatsApp corporate blog, makes three claims.[1][2]
First: WhatsApp caught and disrupted spear-phishing attempts "linked to NSO." The phrasing is careful. Meta is not claiming NSO employees personally clicked "send"; it is claiming the infrastructure and tradecraft match what NSO has used in the past. The previous 2019 Pegasus chain was a 1-click exploit that pushed targets off WhatsApp and onto a malicious site; the June 2026 campaign uses the same off-platform hop.[1]
Second: WhatsApp found NSO-controlled test accounts and groups on the platform and removed them. This is the part that matters for the contempt motion. Running test infrastructure inside WhatsApp is exactly what the October 2025 injunction says NSO cannot do. If Meta can show the test accounts trace back to NSO employees or contractors, the contempt argument is straightforward: you used the platform you are barred from using, to test exploits against the platform you are barred from targeting.[1]
Third: WhatsApp is publishing threat indicators so individuals and security teams can check whether NSO-linked infrastructure hit them across WhatsApp, SMS, email, or other channels. That cross-channel indicator sharing is the operational difference between the 2019 case and the 2026 one. WhatsApp is not just asking the court to punish NSO. It is asking everyone who got the phishing link to check whether their phone has been compromised and, if so, to come forward.[1][2]
The 2025 injunction in one paragraph
Judge Hamilton's October 17, 2025 permanent injunction bars NSO from doing four things, and they are exactly the four things Meta is now alleging NSO did again: reverse-engineering the WhatsApp client, creating or maintaining WhatsApp accounts, routing exploit code through WhatsApp servers, and helping any third party do the same.[4] The court found NSO's harm was "ongoing" in 2025, which is the legal posture that makes contempt easier to argue than a fresh suit would be: the harm is not a new event, it is a continuation of the conduct the court already told NSO to stop.[4]
NSO told the court during the stay motion in late 2025 that the injunction "jeopardizes NSO's principal product, Pegasus, which represented 100 percent of NSO's sales in 2025." It also argued code destruction forced by the injunction "cannot be undone or remedied by money damages." The damages number is mostly symbolic. The injunction number is existential.[4]
The Ninth Circuit appeal is the real chess board
Even as the contempt motion lands, NSO is still fighting the underlying injunction at the Ninth Circuit. NSO filed its appellate brief in November 2025, asking the court to throw out the underlying summary judgment, drop the damages further (NSO wants punitive damages capped at $1.77 million under a 4-to-1 constitutional ratio), and reverse the injunction entirely.[4]
Meta is cross-appealing, asking the Ninth Circuit to restore the full $167.25 million jury award on the theory that Judge Hamilton was too lenient when she reduced it.[4] The appeals court is now looking at two questions: did NSO violate the Computer Fraud and Abuse Act when it reverse-engineered WhatsApp, and if so, what is the right punishment? The contempt motion is a separate track that runs alongside the appeal. If the Ninth Circuit reverses the injunction, the contempt motion dies. If the Ninth Circuit upholds it, Judge Hamilton's contempt finding becomes a second legal hammer over NSO on top of the original one.[4]
The Knight First Amendment Institute at Columbia University filed an amicus brief in the Ninth Circuit opposing NSO's appeal. Reporting on the brief warns that the proliferation of commercial spyware poses a serious threat to free expression and freedom of the press, and characterizes Pegasus as enabling near-perfect surveillance over a target's smartphone.[1] The substantive warning is what the Ninth Circuit will weigh: the appellate panel is being asked to decide whether to allow a vendor that built this kind of surveillance capability to keep operating on the third-party platforms US courts have already ordered it off of.
What NSO is actually saying
NSO has not yet filed a public response to the June 8 contempt motion. Its posture from the Ninth Circuit briefing is that Pegasus is a lawful-intercept tool sold to vetted government customers, that WhatsApp is the wrong forum for the dispute (NSO's customers, not NSO, are the parties using the platform), and that the injunction sets a precedent that will end the lawful-intercept industry in the United States.[4]
None of those arguments reach the contempt motion directly. The contempt motion is narrower: did NSO or people working for NSO create accounts inside WhatsApp to test exploit infrastructure against WhatsApp users after the court ordered them not to. If the answer is yes, the appropriate sanction is whatever Judge Hamilton thinks the conduct warrants: a daily fine, a finding that NSO is in contempt, escalating sanctions if it happens again, or referral for criminal contempt proceedings if the conduct was deliberate enough.[1]
The pattern is the story
The 2026 contempt motion is what happens when a 6-year-old case refuses to stay closed. NSO is still selling Pegasus. NSO is still on the US Entity List, added in 2021 after the Biden administration determined NSO "developed and supplied spyware to foreign governments that used this tool to maliciously target government officials, journalists, businesspeople, activists, academics, and embassy workers."[1] NSO is still fighting the injunction that the US courts say is the only thing keeping Pegasus off a three-billion-user platform. And NSO is still being accused of testing exploits on that platform, which is what the contempt motion alleges.[1][4]
Each round of this case has been a stress test of a different theory of liability. The 2019 complaint tested whether CFAA reaches a foreign spyware vendor. The 2025 jury verdict tested whether punitive damages can punish a foreign vendor at US-jury scale. The October 2025 injunction tested whether a court can order a foreign vendor off a US platform entirely. The 2026 contempt motion tests whether the order, once issued, is enforceable.[3][4]
If the contempt motion sticks, the answer is yes: a US court can order NSO off WhatsApp, NSO can try to ignore the order, and the court can punish NSO for the attempt. That is the precedent that matters, not the dollar amount of the eventual sanction. Once a US court can credibly enforce its injunctions against foreign spyware vendors, every other spyware vendor on the Entity List gets the same message.
What the WhatsApp disclosure actually tells targets
Meta said in the June 8 announcement it is publishing threat indicators so individuals and security teams can check whether NSO-linked infrastructure targeted them across WhatsApp, SMS, email, or other channels.[1][2] That is the operational ask, and it is the part that matters for anyone who got a suspicious link on WhatsApp in the last few months.
The threat model is not "ordinary WhatsApp users got hacked." Pegasus licensing costs run into the millions of dollars per customer per year, and NSO's customer list (judging from past leaks) is overwhelmingly government intelligence and law enforcement agencies. The June 2026 campaign is the same target profile as the 2019 one: journalists, dissidents, human rights defenders, lawyers, politicians, executives.[1][2] If you are none of those things, your phone was probably not on the list. If you are one of those things, the new indicator-sharing from WhatsApp is the easiest way to find out whether you were.
What this means for the broader spyware fight
The contempt motion will play out in parallel with three other NSO pressure points already on the calendar.
First: the Ninth Circuit appeal itself. NSO's opening brief was filed in November 2025. Oral argument has not been scheduled at the time of writing but is expected later in 2026. The appellate ruling will determine whether the injunction survives, which determines whether the contempt motion matters.[4]
Second: the US Entity List status. NSO has been on the Entity List since November 2021, which bars US companies from selling it technology without a license. The Biden-era sanctions framework is the backdrop for the civil litigation; the Trump-era posture is harder to predict, but Commerce has not moved to delist NSO so far in 2026.[1]
Third: the parallel Paragon Graphite pressure. Paragon Solutions, the Israeli competitor that broke off from the NSO orbit in 2024, is facing its own US litigation over its Graphite spyware deployed against WhatsApp users. The structural lesson from the NSO case is being applied to Paragon in real time. If the contempt motion against NSO succeeds, the Paragon plaintiffs have a fresh precedent to cite.[1]
The bottom line
NSO is supposed to be off WhatsApp. The October 2025 injunction says so. The Ninth Circuit appeal is still pending. Meta says NSO has been running test infrastructure and 1-click phishing campaigns inside WhatsApp anyway. The June 8, 2026 contempt motion is Meta's formal request that the court treat the alleged conduct as the violation it appears to be.
The third round of this case is the round that asks whether US injunctions against foreign spyware vendors are real. The damages number, the Entity List status, the Ninth Circuit appeal, the Knight Institute amicus brief: those are all context. The contempt motion is the test.
Sources
- Ars Technica: "Meta alleges NSO violated spyware injunction with new WhatsApp attacks" (Ashley Belanger, June 8, 2026, the Meta announcement, the WhatsApp spear-phishing disruption detail, the test-accounts-and-groups removal, the NSO appeal posture, the Judge Phyllis Hamilton Northern District of California injunction reference, the Knight First Amendment Institute amicus brief quote, the Pegasus full-surveillance capability list, and the 2021 Entity List addition citation)
- Memeburn: "WhatsApp catches fresh NSO spyware attacks in 2026" (Temaz Tra, June 13, 2026, the date Meta made the announcement, the threat indicator sharing across WhatsApp/SMS/email, the 1-click phishing pattern comparison to the 2019 chain, the 2019 case origin story, the $167 million to $4 million punitive damages reduction, and the South African end-user framing)
- Hacker News: "WhatsApp disrupted spear phishing attempts, asks court to hold NSO in contempt" (HN id 48453568, posted 2026-06-08T22:55:45Z, 4 points at scan, the engagement-justification anchor for this article, the cross-cycle beat history, and the litigation-stage taxonomy discussion in the comment thread)
- State of Surveillance: "NSO Group Calls $167M WhatsApp Verdict 'Catastrophic.' The Appeal Is Now Six Months Old." (May 8, 2026, the November 19, 2025 Ninth Circuit appellate brief, the three-front appeal (liability, damages, injunction), the October 17, 2025 permanent injunction order, the $167.25 million to $4 million reduction, the 9-to-1 ratio rationale, the NSO "force NSO out of business" framing, the cross-appeal by Meta, and the Knight First Amendment Institute amicus brief context)
- Reuters: "Meta takes legal action against Israeli spyware firm NSO Group" (Reuters legal, June 8, 2026, the original wire service filing on the contempt motion, the timing of Meta's filing, and the litigation-stage context for the Northern District of California case)
Published: June 21, 2026.