On October 30, 2019, Facebook-owned WhatsApp confirmed that NSO Group’s Pegasus spyware had been used against users in India, including journalists, activists, lawyers, and senior government officials. The campaign exploited CVE-2019-3568, a zero-click vulnerability in WhatsApp’s voice-calling system that could install malware without user interaction. WhatsApp said it alerted India’s Computer Emergency Response Team in May and September 2019, and it deployed server-side and client updates to close the vulnerability in May.
WhatsApp sued NSO Group in the U.S. District Court for the Northern District of California, alleging that Pegasus had infected approximately 1,400 devices. India’s government sought a detailed explanation, while opposition politicians, including the Indian National Congress, alleged that government-linked surveillance had targeted political figures; those broader attribution claims remained contested. NSO maintained that Pegasus was licensed only to governments for counterterrorism and that it lacked visibility into customer use. In 2024, the court held NSO liable under the Computer Fraud and Abuse Act, California computer-access law, and WhatsApp’s terms of service. The court later reduced an initially reported $167 million award to $4 million by May 2025 and barred NSO from targeting WhatsApp users or retaining data obtained in the case. The episode also intensified international scrutiny of commercial spyware exports and drove some users toward Signal and Telegram.