INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

WhatsApp Blocks Pegasus Spyware Campaign Linked to NSO Group

| 2026-06-08 22:51 MEDIUM MEDIUM DATA BREACH MALWARE & BOTNETS
JSON
Executive Summary
AI-generated
WhatsApp has disrupted new spyware related activity linked to NSO Group, the Israeli surveillance company behind Pegasus, and is now asking a US federal court to hold the firm in contempt of a permanent injunction. The targeted individuals were journalists, officials, activists, academics, businesspeople, and embassy workers from various countries including France, with approximately 1,400 users affected by an earlier attack in 2019. WhatsApp found spear phishing efforts that tried to push people toward malicious external websites, similar to methods associated with NSO, and has removed test accounts and groups created on its platform. The company is now seeking to hold NSO accountable for breaching the court order, which was issued after finding that the firm violated federal and state hacking laws in connection with a 2019 attack.
Technical Mitigations AI-generated
• Remove test accounts and groups created on WhatsApp's platform. • Block or hunt for malicious domains: hxxps://<a href="/auth/login?next=/detail/ULPqqp4BHUyMcQl6IaYe" class="ioc-censored-pill text-decoration-none" title="Protected IoC: Sign in to view" data-bs-toggle="tooltip"><span class="badge bg-black text-warning border border-warning border-opacity-75 font-monospace ioc-lock-tag align-middle"><i class="bi bi-lock-fill me-1"></i>[IOC HIDDEN &bull; LOGIN REQUIRED]</span></a>, hxxps://<a href="/auth/login?next=/detail/ULPqqp4BHUyMcQl6IaYe" class="ioc-censored-pill text-decoration-none" title="Protected IoC: Sign in to view" data-bs-toggle="tooltip"><span class="badge bg-black text-warning border border-warning border-opacity-75 font-monospace ioc-lock-tag align-middle"><i class="bi bi-lock-fill me-1"></i>[IOC HIDDEN &bull; LOGIN REQUIRED]</span></a>, hxxps://<a href="/auth/login?next=/detail/ULPqqp4BHUyMcQl6IaYe" class="ioc-censored-pill text-decoration-none" title="Protected IoC: Sign in to view" data-bs-toggle="tooltip"><span class="badge bg-black text-warning border border-warning border-opacity-75 font-monospace ioc-lock-tag align-middle"><i class="bi bi-lock-fill me-1"></i>[IOC HIDDEN &bull; LOGIN REQUIRED]</span></a> • Use stricter account settings to report suspicious activity.
Technical Observables Login Required
Indicators of Compromise (IoCs) Protected

Raw threat telemetry, malicious IP addresses, file hashes, and direct VirusTotal correlation are restricted to authenticated users.

Sign In to View 4 IoCs Create Free Account
gh•••••.com
fr•••••.com
ha•••••.com
ik•••••.com
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
Campaign LinkedCampaign Linked
Target & Sectors
NORTH_AMERICA NORTH_AMERICA
Incident Timeline
‎2026/06/08
SApp has disrupted new spyware-related activity linked to NSO Group, the Israeli surveillance company behind Pegasus.
infrastructure Android
…: hxxps://fr24cast.com hxxps://ghazacast.com hxxps://ikhwancast.com Infographic showing how Pegasus spyware can reach Android and iPhone devices through one click or zero click routes, gain device access, read messages, location, microphone,…
victims 1,400 users
The court had already barred NSO from targeting WhatsApp or its users after finding that the company violated federal and state hacking laws in connection with a 2019 attack on roughly 1,400 users.
Tactical Metrics
Metrics
infrastructure
‎Android
Affected Product
…: hxxps://fr24cast.com hxxps://ghazacast.com hxxps://ikhwancast.com Infographic showing how Pegasus spyware can reach Android and iPhone devices through one click or zero click routes, gain device access, read messages, location, microphone,…
Metrics
victims
1,400
Users
The court had already barred NSO from targeting WhatsApp or its users after finding that the company violated federal and state hacking laws in connection with a 2019 attack on roughly 1,400 users.
Intelligence Sources
HackRead 2026-06-08