Meta Pursues Contempt Action Over Alleged NSO Group Violations

Meta Pursues Contempt Action Over Alleged NSO Activity

Meta Platforms has asked a US federal court to hold Israeli spyware firm NSO Group in contempt for what it describes as continued efforts to target WhatsApp users after a permanent injunction took effect earlier this year. The motion, filed this week, follows Meta's detection of spear-phishing campaigns that the company links to NSO's Pegasus tool. Rather than launching a fresh lawsuit, Meta is seeking enforcement of the existing order through contempt proceedings, which can proceed more quickly and place the burden on the defendant to demonstrate compliance.

The injunction stems from a case that reached a liability finding in October 2025. A US court determined that NSO had violated federal and state law through unauthorized access to WhatsApp systems. NSO was ordered to pay between 167 and 168 million dollars in damages and was barred from further activity against the platform. The company appealed that ruling, the injunction, and the damages award to the Ninth Circuit in November 2025. Meta now argues that NSO has not halted the prohibited conduct while the appeal remains pending.

Details of the Reported Violations Since January

According to Meta, activity linked to NSO has continued after the injunction became active on January 28, 2026. The company points to phishing campaigns that direct users to external malicious sites, a method similar to earlier 1-click operations attributed to the firm. Meta also reports the creation of test accounts and groups on WhatsApp that were later removed. Domains associated with the recent activity include fr24cast.com, ghazacast.com, and ikhwancast.com.

Meta stated that end-to-end encryption on WhatsApp continues to protect personal messages and calls by default. The company urged users to maintain updated applications and to report suspicious messages. These steps reflect standard practices Meta has promoted in previous incidents involving suspected commercial spyware.

NSO's Pegasus Tool and Its Place in Israel's Cyber Sector

Pegasus is designed to exploit zero-day vulnerabilities in mobile operating systems, granting access to location data, contacts, messages, cameras, and microphones without user interaction in some cases. NSO has described the product as an offensive cyber tool sold exclusively to government clients for investigations into terrorism and serious crime. The company has faced scrutiny over the tool's reported use against more than 1,200 individuals in 51 countries.

Israel's cybersecurity industry has grown from defense research programs into a major export sector, with firms based in Herzliya, Tel Aviv, and Beersheba supplying both defensive and offensive capabilities. Successive governments have viewed these companies as contributors to national security exports and technological employment. At the same time, the sector operates under export licensing rules administered by the Defense Ministry, which must balance commercial interests with diplomatic and legal considerations when products reach foreign security services.

US-Israel Technology Ties and Regulatory Pressure

NSO was added to the US Commerce Department Entity List in 2021, a step taken over concerns about activities contrary to American national security interests. The designation restricts the firm's access to US-origin technology and components. Israeli officials have at times raised such listings in bilateral discussions, noting the importance of the technology relationship between the two countries while acknowledging that individual firms remain subject to US enforcement actions.

Meta's decision to seek contempt rather than a new case highlights the legal exposure Israeli companies can face when operating in US courts. Contempt proceedings can result in fines or other sanctions if a judge finds that an order has been disregarded. NSO has maintained that its appeal challenges both the underlying liability and the scope of the injunction, arguing that the restrictions threaten its primary product line, which accounted for all reported sales in 2025.

Implications for Offensive Cyber Tools and Israeli Policy

The current motion occurs against a backdrop of ongoing debate within Israel about the regulation and export of offensive cyber capabilities. Lawmakers and security officials have discussed tighter oversight mechanisms, including enhanced end-use monitoring and clearer distinctions between defensive exports and tools that can be used for surveillance. Critics inside and outside government have questioned whether existing controls sufficiently address risks of misuse or subsequent legal challenges abroad.

Israeli technology firms that sell to government clients often emphasize compliance with local licensing requirements. When disputes reach foreign courts, however, companies can encounter differing standards of evidence and enforcement. The NSO case illustrates how commercial spyware vendors may face simultaneous pressure from export regulators, civil litigation, and reputational concerns in multiple jurisdictions.

Next Steps in the Federal Court Process

The contempt motion will now proceed before the same court that issued the original injunction. Meta will need to present evidence of the alleged violations, while NSO will have the opportunity to argue that it has taken reasonable steps to comply or that the injunction itself remains under appellate review. Observers in both Washington and Tel Aviv will watch whether the court imposes additional sanctions or modifies the existing order.

For Israeli companies active in the cybersecurity field, the outcome may influence decisions about market focus and legal risk management. The case also underscores the intersection of commercial technology sales, national security policy, and international legal accountability that continues to shape Israel's role in global cyber markets.