Israeli NSO Group Fined $168M for Pegasus Spyware Attack on WhatsApp

US jury orders NSO Group to pay $168M to WhatsApp and Meta over Pegasus spyware use in 2019 hack. Meta calls it a major step for user privacy protection.

A US federal jury has ruled in favour of WhatsApp and its parent company Meta, ordering Israeli spyware firm NSO Group to pay nearly $168 million in damages. The verdict follows years of legal battles over NSO’s use of its Pegasus spyware to infiltrate WhatsApp users’ devices.

The decision comes after WhatsApp first filed a lawsuit in 2019, accusing NSO Group of using a vulnerability in the platform’s video calling feature to install spyware on approximately 1,400 devices. Victims included journalists, human rights activists, diplomats, and others across multiple countries.

According to court filings (PDF), NSO’s Pegasus spyware was deployed by sending a WhatsApp call that didn’t even need to be answered. Once the call was placed, the malicious code would install itself, granting access to private messages, calls, camera feeds, and more.

The jury awarded $167.25 million in punitive damages and over $440,000 in compensatory damages to WhatsApp and Meta, bringing the total close to $168 million. Meta said the ruling represents a strong message against surveillance-for-hire businesses and a win for digital privacy.

“The jury’s decision to force NSO to pay damages is a critical deterrent to this malicious industry against their illegal acts aimed at American companies and our users worldwide,” said Meta in a statement following the ruling. The company added that it would continue pushing for stronger legal protections for users and tougher consequences for those abusing digital surveillance tools.

NSO Group has consistently denied wrongdoing, claiming its software is only sold to vetted government agencies for lawful use in preventing crime and terrorism. In response to the ruling, NSO announced its plans to appeal, reiterating that its tools were not intended to target individuals indiscriminately.

“We firmly believe that our technology plays a critical role in preventing serious crime and terrorism and is deployed responsibly by authorized government agencies,” Gil Lainer, vice president of global communications for NSO Group, said in a statement Tuesday.

“We will carefully examine the verdict’s details and pursue appropriate legal remedies, including further proceedings and an appeal,” Lainer added, adding that the company “remains fully committed to its mission to develop technologies that protect public safety” while working within legalities.

Legal experts note that the ruling could set a precedent for holding spyware developers accountable in civil courts, especially when their tools are used against individuals without legal oversight. While NSO faces other lawsuits worldwide, this case may become a turning point in how private surveillance firms are treated under U.S. law.

The lawsuit and resulting fine also show the growing industry of commercial spyware, where private companies create powerful surveillance tools often used far beyond their original purpose. Pegasus has become one of the most high-profile examples due to its widespread use and the sensitivity of its targets.

Nevertheless, Meta’s victory not only brings a degree of closure to a five-year legal dispute but also pressures other spyware vendors to reconsider how their technologies are used and sold. Whether the fine leads to overall changes in the spyware industry remains to be seen, but it’s clear the legal risks are rising.