Pegasus is one of the most feared spyware programs in the world. Installed remotely, it gives access to everything on a phone: messages, photos, microphone, camera. Its maker, the Israeli company NSO Group, has long claimed to be merely a supplier with no responsibility for how its government clients use the product. A U.S. federal court has now ruled against it, and has barred it from targeting WhatsApp again.
What happened
Between late April and early May 2019, Pegasus was installed on about 1,400 devices in some twenty countries through a flaw in WhatsApp calls. A single call was enough to infect the phone, even if the victim never answered. The Citizen Lab, a research laboratory at the University of Toronto, helped WhatsApp identify the victims. It documented more than 100 cases of abusive targeting of journalists and human rights defenders.
WhatsApp then sued NSO in October 2019. The steps that followed:
- December 2024: Judge Phyllis Hamilton finds NSO liable for computer hacking and for violating WhatsApp’s terms of service.
- May 2025: A jury orders NSO to pay nearly US$168 million.
- October and November 2025: The judge reduces the punitive damages to about US$4 million, applying a cap set by case law, but issues a permanent injunction. NSO is no longer allowed to develop or sell a tool that targets WhatsApp, to create WhatsApp accounts, or to analyze its code. The company must also delete the code and data obtained through WhatsApp.
- January 2026: The court of appeals refuses to stay the injunction, which has been in force since. NSO is also ordered to pay WhatsApp nearly US$16 million in legal fees.
In her October 2025 decision, Judge Hamilton sums up what is at stake:
part of what companies such as Whatsapp are ‘selling’ is informational privacy, and any unauthorized access is an interference with that sale
Why this is a victory
According to WhatsApp’s lawyers, this is the first time a spyware maker has been held liable in a U.S. court. The trial also forced NSO to reveal what it had been hiding:
- It is NSO, not its clients, that chooses and triggers the flaw used to infect a phone.
- Pegasus was installed on “between hundreds and tens of thousands” of devices, according to NSO’s head of research.
- NSO kept exploiting WhatsApp flaws until May 2020, after the lawsuit had begun.
- A one-year license could cost up to US$6.8 million.
These facts undercut the industry’s usual defense that makers are simply sellers of neutral tools.
It is not over yet
NSO has appealed. The company also changed hands: in October 2025, a group of American investors took control of it. And in June 2026, WhatsApp asked the judge to hold NSO in contempt of court. Since the injunction took effect, NSO allegedly created at least 23 WhatsApp accounts and 34 groups and sent booby-trapped links. The judge had not yet ruled as of October 2026.
The victory remains important all the same. Those who sell surveillance can now be held accountable.
What you can do
- If you use the app, it is important to install updates as soon as they are available. They fix the flaws that this kind of spyware exploits.
- If you are a journalist, an activist, or in an at-risk situation, turn on Lockdown Mode on iPhone or Advanced Protection on Android.
- Not sure whether you are at risk? Our guide Build your own threat model helps you work out who might target you and which protections are worth the effort.
- If in doubt, Access Now’s helpline offers free help to civil society.
Sources
- Citizen Lab: NSO Group / Q Cyber Technologies: Over One Hundred New Abuse Cases, 2019
- Next: Pegasus, la justice états-unienne condamne NSO Group pour avoir piraté WhatsApp, 2024 (in French)
- TechCrunch: Seven things we learned from WhatsApp vs. NSO Group spyware lawsuit
- CyberScoop: WhatsApp wins injunction against NSO Group, damages reduced
- Permanent injunction against NSO, November 2025
- The Record: WhatsApp says NSO targeted users in violation of court order