Meta Files Federal Contempt Motion Against NSO Group Over Alleged WhatsApp Targeting

A contempt motion moves the WhatsApp-versus-NSO fight from winning a verdict to enforcing one — a test of whether a court order constrains a commercial spyware vendor.

MENLO PARK, CALIFORNIA — Meta said it disrupted phishing activity it attributes to spyware vendor NSO Group that was aimed at WhatsApp users, and on June 8, 2026, asked a federal court to hold the company in contempt for allegedly violating a permanent injunction that barred it from targeting the messaging service. The filing reframes a long-running legal fight: rather than seeking to establish that NSO Group broke the law — a question already decided — Meta is now asking a court to enforce an order it has already issued.

Meta characterized the disrupted activity as social-engineering attempts that tried to trick users into clicking malicious links to direct them to external websites outside WhatsApp, resembling previously reported one-click phishing campaigns it has linked to NSO Group. The company said it acted after investigating user reports and also removed test accounts and groups associated with the activity.

What Meta Said It Disrupted

In a public update, Meta said it had identified and disrupted what it described as NSO-linked social-engineering attempts targeting WhatsApp users. The company's account is deliberately specific about the technique: it said the activity tried to lure users into clicking malicious links that would send them to external websites outside the WhatsApp environment, a pattern it likened to previously reported "one-click" phishing campaigns it has attributed to NSO Group.

Meta said it acted after investigating reports from users, and that as part of the same effort it caught and removed test accounts and groups that it said were created on WhatsApp in connection with the activity. The company also published threat indicators it said could help people determine whether they had been targeted through text messages, email, WhatsApp messages, or other channels.

It is worth being precise about what this disclosure does and does not establish. Meta's statement describes disrupted phishing and social-engineering attempts; it is the company's own characterization of activity it attributes to NSO Group. Whether any spyware was successfully delivered to a device as a result of this specific activity is not asserted in Meta's account, and CyberSignal is not treating successful infection as an established fact. The reporting that follows is anchored on Meta's filing and its published statement rather than on any reconstruction of how such delivery would work.

The Permanent Injunction NSO Is Alleged to Have Violated

The contempt motion is built on an order that already exists. In its earlier litigation against NSO Group, Meta secured a court ruling against the vendor and a permanent injunction that prohibited NSO Group from targeting WhatsApp and its users. That injunction is the legal backbone of the new filing: Meta's argument is not that some new wrong needs to be proven from scratch, but that conduct already forbidden by a standing order has resumed.

According to reporting on the case, the underlying civil judgment also carried a substantial monetary award against NSO Group, and the company has been pursuing an appeal of the ruling. That appellate posture matters to how the contempt question is likely to be litigated, because NSO Group has separately argued that the injunction's restrictions are sweeping. Meta, for its part, has framed continued activity as evidence that the existing order — and NSO Group's placement on the U.S. government's export-control Entity List — should remain firmly in place.

The specific terms of the injunction beyond what reporting summarizes, and the precise procedural details of the new filing, are matters of court record that CyberSignal is not independently characterizing here. What is clear from Meta's own statement and from contemporaneous reporting is the shape of the claim: an existing permanent injunction barred NSO Group from targeting WhatsApp, and Meta now alleges that bar was crossed.

Why a Contempt Motion Changes the Legal Posture

A contempt motion is a fundamentally different instrument from the suit that produced the original judgment. The first case asked a court to decide whether NSO Group was liable at all. A contempt proceeding starts from the premise that the question of wrongdoing has already been answered and a binding order issued, and asks instead whether that order is being obeyed — and, if not, what the court should do about it.

That shift carries practical weight. Contempt is the mechanism by which courts enforce their own orders, and it can open the door to remedies aimed at compelling compliance rather than simply compensating past harm. For a commercial spyware vendor, the central test such a filing poses is whether a court order functions as a genuine operational constraint or merely as a liability already priced in. The outcome will signal how much practical force an injunction carries against a company whose core product is, by design, built to operate covertly.

It also raises the stakes on attribution and evidence. To prevail on contempt, the moving party generally has to persuade the court that the conduct it is complaining about is both real and squarely within the scope of the existing order. That places Meta's threat-intelligence findings — and the indicators it has published — at the center of the dispute, and makes the precision of its attribution to NSO Group consequential in a way that goes beyond public messaging.

The Pattern: Meta's Multi-Year Legal Track Record Against Commercial Spyware Vendors

The contempt filing is the latest move in a campaign Meta has pursued against the commercial spyware industry for several years, using litigation as a primary lever. WhatsApp's original case against NSO Group was among the most prominent attempts by a major platform to hold a spyware vendor accountable in court for targeting its users, and the permanent injunction that resulted was a notable outcome precisely because it imposed a forward-looking prohibition rather than only a backward-looking penalty.

That history is the context in which this filing should be read. A company that has invested in a multi-year legal strategy now confronts the question every plaintiff who wins an injunction eventually faces: what happens when the defendant is alleged to have kept going anyway. Meta's decision to seek contempt rather than file a fresh suit signals an intent to make the existing order do the work it was designed to do.

The episode also sits within a broader policy conversation about how democracies should constrain mercenary spyware, including through export controls and sanctions designations. Meta explicitly tied its filing to NSO Group's Entity List status, arguing that continued targeting is itself an argument for keeping restrictions in place. That framing connects a private enforcement action to ongoing government deliberations over the commercial spyware market.

Open Questions

Several important points remain unresolved. NSO Group did not respond to reporters' requests for comment on Meta's accusations, so the vendor's response to the contempt filing itself is not yet on the public record. How the company will contest the motion — whether by disputing attribution, arguing the conduct falls outside the injunction's scope, or raising its pending appeal — is not yet known.

Equally unsettled is the factual core that a court will ultimately have to weigh: the strength and specificity of Meta's attribution, whether the disrupted activity is found to fall within the injunction's terms, and what remedy, if any, a judge concludes is warranted. CyberSignal is not asserting that spyware was successfully delivered to any user in connection with this activity, nor naming a specific spyware variant, because Meta's published statement does not establish those points.

What is firmly established is narrower but consequential: Meta says it disrupted phishing activity it attributes to NSO Group aimed at WhatsApp users, and it has filed a federal contempt motion arguing that the activity violates a standing permanent injunction. The case now becomes a test of enforcement — of whether a court order, once won, can actually bind a commercial spyware vendor in practice.

Sources