Facebook owner Meta set for $167 million windfall after NSO Group ordered to pay up over WhatsApp spyware campaign

• NSO Group must pay out nearly $167.5 million in damages to WhatsApp
• 1,400 users were compromised through an audio calling vulnerability
• Meta wants to donate to digital rights organizations

NSO Group has been ordered to pay over $167 million in punitive damages and nearly half a million ($445,000) in compensatory damages to WhatsApp after a five-year legal battle.

The fines stem from a 2019 hacking campaign affecting over 1,400 WhatsApp users, with NSO using the Pegasus spyware to exploit an audio calling vulnerability on the mobile app.

Among those affected were high-profile individuals and public figures, such as journalists, activists and diplomats, with the Israeli cyber-intelligence firm's spyware also capable of accessing emails, texts, financial data, location data and remote camera and microphone activation.

Israel's NSO Group to pay over $167 million in damages to WhatsApp

"Put simply, NSO’s Pegasus works to covertly compromise people’s phones with spyware capable of hoovering up information from any app installed on the device," Meta explained in an announcement.

Meta noted that Pegasus, when installed on an affected handset, has the capability of "hoovering up information from any app installed on the device."

Given the extent of data types Pegasus targets, Meta has also confirmed that `"WhatsApp was far from NSO’s only target."

The tech giant didn't name any other affected companies, but NSO has admitted that it spends tens of millions of dollars annually to develop malware installation methods, which can include via instant messengers, browsers and operating systems – both iOS and Android.

NSO Group claims that it sells its spyware to governments only, however there are increasing attacks on citizens suggesting that malicious actors have also been able to get their hands on the spyware – be they government affiliates or otherwise.

"Pegasus is designed to be stealthy and evade forensic analysis, avoid detection by anti-virus software, and can be deactivated and removed by operators," The Citizen Lab explained.

Even after six years, Meta has acknowledged that there could be a long way to go before any damages are paid out, however the company "would like to make a donation to digital rights organizations that are working to defend people against such attacks around the world" as a result of its success in court.

You might also like

• New spyware found to be snooping on thousands of Android and iOS users
• We're listed the best Android antivirus apps you may want to install
• These are the best mobile VPNs