WhatsApp vs. NSO: What the Contempt Motion Signals

Meta's contempt motion against NSO Group shows Pegasus ops continued through WhatsApp during active litigation. Here's what the record means for defenders and researchers.

A US federal court is being asked to hold NSO Group in contempt. WhatsApp’s allegation — documented by the Citizen Lab (https://citizenlab.ca/whatsapp-accuses-nso-of-fresh-pegasus-targeting/) — is that NSO continued deploying Pegasus through WhatsApp infrastructure after litigation was already underway. Not before the lawsuit. During it.

That single fact is the thing worth sitting with before anything else.

The Legal and Technical Context

WhatsApp’s original suit against NSO, filed in October 2019 in the US District Court for the Northern District of California (Case No. 4:19-cv-07123-PJH), alleged NSO used WhatsApp servers to deliver Pegasus to roughly 1,400 devices across a two-week window. The 2019 campaign exploited a buffer overflow in WhatsApp’s VOIP stack (CVE-2019-3568) — zero-click, no user interaction required.

The contempt motion is not about a missed discovery deadline. WhatsApp is claiming NSO actively resumed or continued targeting through the same platform it had already been sued over. If the court agrees, the sanctions exposure goes well beyond the original civil liability question.

The precise exploit chain behind the alleged fresh targeting has not been detailed in the public case record yet. Whether it’s a new zero-click capability, a click-based delivery, or something hybrid is unknown from open sources. That ambiguity is itself an analytical signal: we do not know if NSO has a functioning zero-click WhatsApp vector right now, and the legal record hasn’t closed that question.

What This Means for Offensive Security Researchers

Threat actor resilience under legal pressure

NSO has absorbed the Commerce Department’s Entity List addition (November 2021, https://www.bis.doc.gov/index.php/documents/about-bis/newsroom/press-releases/2914-2021-11-03-bis-press-release-entities-added-to-entity-list-2/file), civil litigation, and years of sustained public reporting without apparent operational shutdown. Red teams modeling APT behavior should treat this as a concrete data point, not an edge case. Legal and reputational pressure does not reliably produce operational pause at the high end of the threat landscape.

Messaging platforms as delivery infrastructure

WhatsApp’s end-to-end encryption is real, and it’s also irrelevant to this attack class. Pegasus doesn’t break the encryption — it compromises the device before or after the plaintext exists. The trust users extend to encrypted messaging apps is precisely what makes them attractive delivery surfaces. That cognitive gap is harder to close with technical controls than with a firewall rule, and offensive researchers should be modeling it explicitly in mobile-focused adversary simulations.

OSINT tracking of commercial spyware infrastructure

Citizen Lab’s domain fingerprinting methodology — passive DNS monitoring, TLS certificate analysis, WHOIS correlation — is documented across multiple public reports. Their Candiru analysis (https://citizenlab.ca/2021/07/hooking-candiru-another-mercenary-spyware-vendor-comes-into-focus/) is a representative example of the approach applied to a different vendor. The infrastructure reuse patterns it describes are operationalizable in Shodan, Censys, and Microsoft Defender Threat Intelligence. NSO’s infrastructure fingerprints are in the same class. Researchers building client exposure assessments around commercial spyware risk should be running these queries, not treating the Citizen Lab reports as terminal.

What This Means for Defensive Security Professionals

Mobile endpoint visibility is still broken

Pegasus has been confirmed against fully patched iOS devices via zero-click vectors. MDM policies and standard EDR tooling don’t provide equivalent visibility on mobile that they do on a managed Windows endpoint — iOS in particular is structurally closed to the kernel-level telemetry most EDR platforms depend on. If your organization has executives, legal counsel, journalists, or human rights staff in its user population, those people have a materially different mobile threat profile than a standard enterprise user, and the controls need to reflect that.

Litigation is not remediation

The contempt motion is evidence against the instinct to deprioritize Pegasus IOCs because NSO is in legal trouble. A vendor under active civil litigation apparently continued operations. Treat Pegasus as an active threat, not a historical one.

Zero-click delivery invalidates most user-behavior training for this vector

Security awareness programs built around “don’t click suspicious links” don’t address zero-click delivery. They’re not wrong — phishing remains a high-volume threat — but they’re irrelevant to this specific class. Communicating that distinction clearly to leadership and to high-risk users matters, because the natural assumption is that careful behavior provides protection it doesn’t actually provide here.

Communication platforms need to be in your vendor risk scope

If a messaging platform’s infrastructure can be turned into a delivery vector at scale — not through social engineering but through exploitation of the platform itself — then third-party risk assessments need to cover communication vendors: their vulnerability disclosure history, patch cadence, and responsiveness to abuse. Most vendor risk programs aren’t built with that lens.

Concrete Steps

For Threat Intelligence and OSINT Practitioners

Follow the PACER docket directly. WhatsApp Inc. v. NSO Group Technologies Ltd., Case No. 4:19-cv-07123-PJH, Northern District of California. As technical exhibits are unsealed, they’ll contain infrastructure and behavioral data that’s directly usable for threat intelligence — this is primary-source material, not secondary reporting.

Operationalize Citizen Lab’s domain fingerprinting methodology in your passive DNS monitoring. The patterns are documented; the tooling (Shodan, Censys, MDTI) is available. The gap is usually the workflow integration, not the technique.

Use MVT forensically, not as a checkbox. Amnesty International’s Security Lab published the forensic methodology for Pegasus detection on iOS and Android (https://www.amnesty.org/en/latest/research/2021/07/forensic-methodology-report-how-to-catch-nso-groups-pegasus/). The Mobile Verification Toolkit derived from that work is actively maintained. Running it once against a high-risk device means nothing without periodic re-runs — Pegasus artifacts are time-bounded.

For Defensive Security Teams

Run MVT on high-risk devices on a scheduled basis. The tool (https://github.com/mvt-project/mvt) does iOS backup analysis and Android device forensics against known Pegasus IOCs. It’s not continuous monitoring — it requires manual engagement — but it’s the most accessible public option for this threat class and it’s not being widely used by enterprise security teams who have the user populations that warrant it.

Enable Lockdown Mode for high-risk iOS users. Apple introduced it in iOS 16 specifically to harden against commercial spyware. The functionality restrictions are real and it’s not appropriate as a blanket policy, but for executives and legal teams who are plausible high-value targets, it’s a proportionate control and it demonstrably reduces attack surface.

Update your mobile threat model explicitly. If it currently treats mobile devices as lower-risk than laptops, the WhatsApp-NSO record is sufficient justification to revise that. Assign ownership, define detection thresholds, document the threat. A threat model that doesn’t acknowledge zero-click mobile exploitation in 2024 has a gap.

For Offensive Security Researchers

Use the NSO legal record in client scoping conversations. The documented facts — delivery vector, targeting at scale via trusted platform, evasion of encrypted communications — are a credible, sourced scenario for red team conversations with clients who are underweighting mobile spyware risk. “A federal court filing describes this” lands differently than “we’ve seen this in the wild.”

The Takeaway

The contempt motion is an OSINT signal, not just a legal event. It tells us commercial spyware vendors don’t necessarily stand down under legal or regulatory pressure. It tells us encrypted messaging platforms remain viable delivery surfaces for sophisticated implants. And it confirms that the gap between legal accountability and operational deterrence in the commercial surveillance space is wide enough to drive a campaign through.

The court record, Citizen Lab research, and MVT constitute an open-source intelligence picture that requires active cultivation. Start with the PACER docket and work forward.