After a protracted legal battle spanning more than five years, Meta Platforms, Inc. has prevailed in its lawsuit against Israel-based NSO Group, a company specializing in cyber intelligence technologies. The court has ordered NSO Group to pay Meta $168 million in damages resulting from a cyberattack carried out in May 2019, which targeted approximately 1,400 devices belonging to WhatsApp users.
The legal proceedings revealed that NSO Group exploited a zero-day vulnerability in WhatsApp’s security infrastructure to distribute its Pegasus spyware. This malicious software was deployed on mobile devices owned by journalists, human rights activists, and other individuals. According to Meta’s representatives, Pegasus possesses capabilities enabling unauthorized access to a wide range of user data, including financial information, geolocation data, emails, and text messages. Furthermore, the spyware can remotely activate an infected device’s microphone and camera without the user’s consent.
The court’s ruling sets a significant precedent as one of the first instances where a spyware developer has been held legally accountable for its product’s misuse. This verdict may have far-reaching implications for the cyber intelligence industry, potentially establishing new standards of liability for the development and distribution of malicious software.