Meta's WhatsApp has detected new spyware attacks linked to NSO Group, the Israeli surveillance firm behind the notorious Pegasus malware. The company disrupted a phishing campaign targeting its users, marking another violation of existing court orders against NSO.
WhatsApp confirmed it caught and blocked a fresh wave of attacks from NSO Group, the spyware developer previously sanctioned by the U.S. Department of Commerce. The phishing campaign attempted to compromise WhatsApp users through deceptive messages designed to install NSO's surveillance tools.
This marks the latest chapter in an ongoing battle between Meta and NSO Group. WhatsApp has previously sued NSO over Pegasus attacks that targeted human rights activists, journalists, and government officials worldwide. In 2021, the messaging platform disclosed that approximately 1,400 users were compromised through the spyware.
NSO Group claims its tools are sold exclusively to governments for law enforcement and counterterrorism purposes. However, investigations have repeatedly documented the spyware's deployment against civil society targets, contradicting the company's stated restrictions.
The newly detected campaign represents a clear breach of judicial measures imposed on NSO. Courts have previously issued orders limiting the company's operations, yet Meta's announcement indicates NSO continues active targeting efforts.
WhatsApp's disruption of the phishing campaign prevented widespread compromise of its user base. The company stated it informed relevant authorities and took technical measures to block the attack vectors.
NSO Group has faced mounting international pressure, including placement on trade blacklists and calls for sanctions. Multiple countries have launched investigations into alleged misuse of Pegasus, while human rights organizations have documented cases of the tool targeting activists and journalists.
Meta did not disclose the specific targeting criteria or geographic scope of the latest campaign. The company continues investing in security measures and monitoring for NSO-linked threats across its messaging platforms.
Israeli cybersecurity firm Check Point has released security updates for a critical VPN vulnerability exploited in active zero-day attacks. The flaw affects Remote Access VPN and Mobile Access deployments and has been linked to the Qilin ransomware group.
Attackers can exploit three chained vulnerabilities in Ubiquiti's UniFi OS server to execute remote code with root privileges without authentication. The flaws have already been patched.
Gogs has released a security patch for a critical zero-day vulnerability that enables remote code execution on exposed instances. The flaw allows attackers to compromise servers and access all repositories, including private ones.
Oxford University disclosed a data breach after its third-party careers services provider, Group GTI, notified the institution that its CareerConnect platform had been compromised.