Meta filed the lawsuit against NSO Group on October 29, 2019, in the U.S. District Court for the Northern District of California, alleging that NSO had exploited a vulnerability in WhatsApp's calling feature to deliver its Pegasus spyware to approximately 1,400 users. Court documents also revealed that the NSO Group used at least one more zero-day vulnerability in WhatsApp software to target users with spyware even after Meta's lawsuit had been submitted. A U.S. federal jury has ordered Israeli spyware vendor NSO Group to pay WhatsApp $167,254,000 in punitive damages and $444,719 in compensatory damages for a 2019 campaign that targeted 1,400 users of the communication app. "Today's verdict in WhatsApp's case is an important step forward for privacy and security as the first victory against the development and use of illegal spyware that threatens the safety and privacy of everyone," commented Meta, WhatsApp's owner, in an announcement. The fines stem from a May 2019 campaign when NSO attempted to infect 1,400 WhatsApp users with its Pegasus spyware using a WhatsApp zero-day vulnerability. It was later revealed that the vulnerability NSO leveraged during this operation was CVE-2019-3568, a buffer overflow in the WhatsApp VOIP stack, allowing attackers to send specially crafted RTCP packets to a target phone number to achieve remote code execution. Hamilton ruled that NSO Group is liable for violating U.S. hacking laws and WhatsApp's Terms of Service, granting partial summary judgment in WhatsApp's favor and moving the case to a jury trial to determine damages. The verdict is considered a landmark case for being the first time a spyware vendor is held accountable in court, and could send ripples across the commercial spyware industry. Finally, WhatsApp was awarded punitive damage compensation of $167,254,000, plus an extra $444,719 compensation for the incident investigation, vulnerability patching, and user notification.
This Cyber News was published on www.bleepingcomputer.com. Publication date: Wed, 07 May 2025 14:10:11 +0000