\n<\/p>\n
Last year, WhatsApp made history by securing a landmark <\/span>verdict<\/span><\/a> and permanent injunction barring NSO Group \u2014 a spyware firm <\/span>blacklisted<\/span><\/a> for actions contrary to US national security \u2014 from targeting WhatsApp and its users ever again. The court was unequivocal: NSO violated the federal and state laws against hacking. Today, we\u2019re asking the court to hold them in contempt of that order.<\/span><\/p>\n We successfully disrupted NSO-linked social engineering attempts, after investigating user reports. They tried to trick people into clicking on malicious links to drive them to external websites outside of WhatsApp, similar to previously <\/span>reported<\/span><\/a> 1-click phishing campaigns linked to NSO. We also caught them creating test accounts and groups on WhatsApp, which we took down.\u00a0<\/span><\/p>\n We are sharing threat indicators so that anyone can check if they were targeted by NSO-linked social engineering attempts across any platform \u2014 be it text message, email, WhatsApp message, or something else.<\/span><\/p>\n Since 2019, our case has shown that NSO continues to build spyware tools to target people\u2019s devices. Its CEO confirmed in court that the company\u00a0 looks for \u201cvectors, or ways to access the phone\u201d beyond WhatsApp, targeting browsers, operating systems, and other applications.\u00a0<\/span><\/p>\n No technology is off-limits to surveillance-for-hire firms, whose reported targets range from journalists to government officials, military personnel, and humanitarian organizations.\u00a0<\/span><\/p>\n When a malicious company on the US government\u2019s Entity List continues to defy US courts, existing restrictions must remain firmly in place. Easing them would undermine US national security and put American companies and billions of people worldwide who depend on secure communications at risk.<\/span><\/p>\n When we originally discovered NSO\u2019s 2019 attack, Citizen Lab helped us investigate it and notify the people who were targeted. When the case first went to trial, our industry peers and other organizations supported it, strengthening the legal record.\u00a0<\/span><\/p>\n Last month, we <\/span>were<\/span><\/a> joined<\/span><\/a> by 12 prominent civil rights organizations \u2014 a coalition of security researchers, privacy advocates, and digital rights experts \u2014 who filed their amicus briefs to fight NSO\u2019s appeal against the permanent injunction.\u00a0<\/span><\/p>\n Today, we are beginning to deliver on our <\/span>promise<\/span><\/a> to support digital rights organizations working to defend people against spyware attacks by making a significant contribution to the <\/span>Spyware Accountability Initiative<\/span><\/a> (SAI). SAI supports dozens of organizations worldwide focused on forensic research, user support, and advocacy.\u00a0<\/span><\/p>\n For example, a Citizen Lab zero-day <\/span>discovery<\/span><\/a> led to an Apple security update for over a billion devices. This year, a Greek court issued the first-ever criminal conviction of spyware company executives, a case built on forensic evidence and investigative <\/span>reporting<\/span><\/a> by civil society.<\/span><\/p>\n This work is demanding, often dangerous, and consistently under-resourced compared to the spyware industry that continues to develop new exploits. We\u2019re committed to doing our part to support this critical effort.<\/span><\/p>\n As always, WhatsApp users\u2019 personal messages and calls remain protected with default end-to-end encryption. We encourage people to keep their apps and devices up to date and report suspicious activity so we can quickly investigate and take action. For those who believe they may be targeted by sophisticated cyber attacks, we strongly recommend enabling<\/span> strict account settings<\/span><\/a> to harden their WhatsApp accounts even more.<\/span><\/p>\nCatching and Disrupting NSO\u2019s Targeting Attempts<\/h2>\n
Spyware Is a National Security Threat<\/h2>\n
No Company Can Fight Spyware Alone<\/h2>\n
Threat Indicators<\/h2>\n
Malicious domains:<\/h3>\n
\n