A Northern California federal judge ruled that WhatsApp failed to prove a prominent spyware company violated a court injunction requiring it to stop using the messaging app’s infrastructure to mount snooping attacks on customers.
The ruling Friday by Judge Phyllis Hamilton was in response to an appeal WhatsApp filed in June. The Meta-owned messaging service wanted the judge to hold the NSO Group — maker of the powerful zero-click Pegasus spyware deployed against 1,400 app users in 2019 — in contempt for what WhatsApp called spearphishing attacks against individuals.
Hamilton issued the injunction against NSO in 2025 and fined it $4.4 million, agreeing with WhatsApp that the spyware maker had improperly abused its infrastructure to target and, in some cases, infect users’ devices with spyware.
Despite winning the overall case, however, WhatsApp failed to convince Hamilton that NSO had violated the injunction because it did not provide enough “clear and convincing evidence” of the alleged misbehavior, the judge said.
“In the court’s view, plaintiffs took a calculated risk in choosing to limit the level of detail in their supporting evidence,” Hamilton’s opinion said.
WhatsApp put forward evidence that solely relied on the testimony of Andrew Blaich, a security engineer investigator on Meta’s threat intelligence team.
Blaich submitted a declaration that alleged he found 23 new Whatsapp accounts carrying
“technical and behavioral signatures that Meta has previously associated with NSO
testing, including account registration patterns, device and other related information, and
connections to known NSO-controlled infrastructure,” according to the opinion, quoting from Blaich’s declaration.
WhatsApp told Hamilton it was concerned about providing specifics about how Blaich found the activity because divulging methods could make it much harder for the tech giant to fight spyware companies in the future.
In September 2024, Apple dropped a suit against NSO because it said continuing the case risked exposing “vital security information.”
Digital freedoms advocates condemned the decision Hamilton issued Friday, saying it would be self-sabotage for WhatsApp to unveil its tracking protocols publicly.
“Judges working on spyware cases should consider in making these decisions that WhatsApp exposing its own research and detection methods could provide enormous benefits to NSO, as well as foreign intelligence services, exploit developers and criminals that can learn how sophisticated spyware is detected and how platforms operate,” Natalia Krapiva, senior tech-counsel at Access Now told Recorded Future News via text message.
Krapiva said that requiring such disclosures in order to hold NSO accountable would “lead to complete impunity for the spyware industry.”
WhatsApp and NSO Group did not immediately respond to a request for comment.
