By 
A U.S. federal jury has ordered Israeli surveillance firm NSO Group to pay Meta-owned WhatsApp nearly $168 million in damages, concluding a high-profile legal battle over the use of Pegasus spyware to target over 1,400 users worldwide.
The decision comes more than four months after U.S. District Judge Phyllis J. Hamilton ruled that NSO Group violated federal laws by exploiting WhatsApp’s servers to deploy Pegasus. The spyware was used to surveil journalists, human rights defenders, and political dissidents, according to a lawsuit WhatsApp filed in 2019.
Court records revealed the global scale of the targeting, including 456 victims in Mexico, 100 in India, 82 in Bahrain, 69 in Morocco, and 58 in Pakistan—spanning 51 countries in total. The attacks exploited a zero-day vulnerability (CVE-2019-3568, CVSS score: 9.8) in WhatsApp's voice call feature.
Judge Hamilton noted Pegasus was transmitted through WhatsApp’s California-based servers 43 times during May 2019. "Our case against spyware developer NSO made history," said Will Cathcart, head of WhatsApp, adding that the jury’s decision serves as a critical warning to the spyware industry.
In total, the jury awarded $167.25 million in punitive damages and an additional $444,719 in compensatory damages for the resources WhatsApp expended to halt the attacks.
Cathcart also announced plans to seek a permanent injunction against NSO Group and pledged donations to digital rights groups fighting spyware abuse.
NSO Group has maintained that its tools are intended for lawful use by governments to combat crime and terrorism. In a statement, it said it would pursue further legal options. The company was blacklisted by the U.S. in 2021 over its involvement in "malicious cyber activities."
