On May 6, WhatsApp secured a landmark legal victory against NSO Group, the notorious spyware developer, with a jury ordering NSO to pay over $167 million in damages to the messaging giant owned by Meta. The case, spanning more than five turbulent years, began in 2019 when WhatsApp accused NSO of exploiting a vulnerability in its audio-calling feature to hack into the phones of over 1,400 users.
The trial, concluded after a week of testimony in court, included high-level statements from NSO Group’s CEO, Yaron Shohat, and several WhatsApp team members involved in investigating the breach. Detailed testimony offered fresh insights into how exactly NSO’s highly sophisticated Pegasus spyware had infiltrated WhatsApp’s systems.
WhatsApp lawyer Antonio Perez described the spying method as a “zero-click” attack, designed to infect phones without any user interaction. Pegasus exploited WhatsApp’s infrastructure by initiating fake calls containing hidden malicious instructions. This technique prompted targeted phones to contact a remote server, from which the spyware was uploaded. Perez emphasized that telephone numbers alone were sufficient to initiate these attacks.
Tamir Gazneli, NSO’s Vice President of Research and Development, acknowledged under oath that the zero-click method represented a significant technological advancement for their spyware platform.
Perhaps most alarmingly, testimony revealed NSO Group continued targeting WhatsApp users even after the lawsuit had commenced. Gazneli confirmed that the system, identified internally by project names “Erised,” “Eden,” and “Heaven,” collectively termed “Hummingbird,” remained operational well into 2020 despite active legal proceedings.
In another startling admission, NSO openly acknowledged it conducted hacking operations against a U.S. phone number as part of a demonstration for the FBI—a striking deviation from the company’s longstanding public claim that its spyware was prevented from attacking any American numbers. NSO attorney Joe Akrotirianakis clarified this marked a single, deliberate exception, specifically configured for a potential U.S.-based deployment that ultimately never occurred.
Trial documents and statements also disclosed operational and financial details about NSO’s business. Shohat explained the Pegasus spyware interface offered to government users automatically selected appropriate hacking methods based on necessity, without allowing operatives to specify particular techniques. Additionally, he revealed the company employed approximately 350 to 380 personnel, with around 50 individuals working for NSO’s parent firm, Q Cyber.
Ironically, NSO and Apple, whose iPhones have frequently been targeted by Pegasus, share office space within the same skyscraper in Herzliya, Israel, occupying separate floors but commonly sharing elevators, a detail Shohat humorously noted in his testimony.
Court documents specifically revealed pricing structures, showing that NSO charged European governmental clients around $7 million for Pegasus access between 2018 and 2020, with additional “covert vectors” costing approximately $1 million extra. Nevertheless, these sums paled in comparison to the tens of millions reportedly paid by Saudi Arabia and Mexico for longer-term, extensive surveillance contracts.
Amid legal battles, NSO also painted a grim picture of its finances. Shohat recounted NGO’s recent financial distress, detailing sizable multimillion-dollar losses and rapidly diminishing cash reserves amid high monthly expenditures on employee salaries and costly R&D initiatives. Shohat cautioned that the mandated damages would strain, if not overwhelm, the already embattled company, stating plainly in court, “We are struggling to keep our head above water.”
Ultimately, this high-profile trial exposed extraordinary insights into the shadowy operations and capabilities of the spyware industry, with NSO Group’s Pegasus technology at its center—highlighting issues around encryption, cybersecurity, and the international trade of digital espionage tools.
