Court Document Exposes Global Reach of NSO Spyware Targeting WhatsApp Users
San Francisco, CA – April 9, 2025, 12:26 PM PDT
A newly released court document from the ongoing lawsuit between Meta-owned WhatsApp and Israeli spyware firm NSO Group has unveiled the staggering scope of a 2019 hacking campaign, identifying 1,223 WhatsApp users across 51 countries as targets of NSO’s notorious Pegasus spyware. Published on Friday as part of WhatsApp’s landmark case filed in 2019, the document offers a rare glimpse into the geographic spread and scale of surveillance enabled by NSO’s technology, spotlighting the pervasive threat to privacy faced by individuals worldwide.
The document, an exhibit in the U.S. District Court for the Northern District of California, details how NSO exploited a vulnerability in WhatsApp’s systems between April and May 2019 to deploy Pegasus, a powerful surveillance tool capable of extracting messages, photos, and location data, and even activating a phone’s microphone and camera. While WhatsApp initially reported 1,400 targets in its original complaint, this latest filing specifies 1,223 victims, with Mexico leading the list at 456 cases, followed by India, the United Kingdom, the United States, and others including Syria, where NSO cannot legally export its tech due to international sanctions. Researchers suggest this discrepancy may reflect refined data or unreported cases, but the numbers underscore what one expert called “the true scale of the spyware problem.”
WhatsApp’s lawsuit, which accuses NSO of violating U.S. hacking laws and its terms of service, scored a historic victory in December 2024 when Judge Phyllis Hamilton ruled NSO liable for breaching the Computer Fraud and Abuse Act and California’s anti-hacking statutes. The case now heads to a damages hearing later this month, potentially setting a precedent for accountability in the shadowy spyware industry. The newly publicized list of victim locations, spanning journalists, human rights activists, and government officials, fuels debates over which NSO clients—government agencies paying up to $6.8 million annually for Pegasus licenses—were behind the attacks. Notably, the document doesn’t confirm whether a victim’s location matches the targeting government, leaving open the possibility of cross-border surveillance.
“This is a chilling snapshot of how pervasive and indiscriminate spyware has become,” said Katitza Rodriguez, policy director at the Electronic Frontier Foundation, in a statement to TechCrunch. Posts on X echoed this alarm, with users like @rune_cipher warning, “Today’s privacy breacher is tomorrow’s cautionary tale.” The data reveals the campaign’s intensity—over 1,200 targets in just two months—highlighting NSO’s operational reach, which netted the firm at least $31 million in 2019 revenue, per court filings.
NSO has maintained that Pegasus is sold solely to governments for combating crime and terrorism, with spokesperson Gil Lainer reiterating on April 9 that “the system is operated solely by our clients” and that NSO lacks access to gathered intelligence. Yet, unsealed depositions from November 2024 contradict this, revealing NSO—not its clients—directly installs and extracts data, controlling the process down to pressing “Install” on a target’s phone number. This revelation, alongside the victim list, intensifies scrutiny on Israel’s oversight of NSO, especially after reports of government efforts to suppress case-related disclosures.
As the legal battle nears its next phase, the document’s release amplifies calls for tighter regulation of the spyware trade. With victims spanning democracies and authoritarian states alike, the WhatsApp case underscores a global privacy crisis—one that, as Rodriguez noted, “hints at thousands more who were never notified or checked.” The world now watches whether this ruling will curb NSO’s operations or merely mark a symbolic win in an escalating digital arms race.
