WhatsApp Spyware Case Reveals Mexico, Saudi Arabia, Uzbekistan as NSO Group’s Govt Clients

• Mexico, Saudi Arabia, and Uzbekistan governments were revealed to be NSO Group customers.
• The details surfaced in a recent hearing in the WhatsApp versus Pegasus case. 
• This marks the first time NSO has officially confirmed specific government users of its spyware.

New details have surfaced about NSO Group's spyware tool, Pegasus, and the international clients accused of misusing it in a 2019 WhatsApp hacking campaign, as the company’s lawyer named Mexico, Saudi Arabia, and Uzbekistan as confirmed customers of NSO Group.

The recent revelations were presented during a court hearing last week that is connected to the lawsuit between Meta-owned WhatsApp and the Israeli spyware vendor, according to a hearing transcript.

NSO Group’s lawyer, Joe Akrotirianakis, disclosed that these governments were part of a larger group of clients who allegedly deployed the Pegasus spyware during a hacking campaign in 2019. 

Akrotirianakis hinted that a list of affected countries, which was unsealed in the lawsuit, could overlap with NSO Group’s customer base.

While the list of countries where victims were located reportedly includes 51 nations such as Bahrain, India, Morocco, Spain, and the United States, Saudi Arabia—which was named as an NSO customer in the hearing—is notably absent. 

This discrepancy suggests that some clients targeted individuals outside their borders, as previously reported in incidents such as Mexico targeting a journalist’s child in the United States.

WhatsApp’s lawsuit, filed in 2019, accused NSO Group of exploiting a vulnerability in its platform to deliver Pegasus spyware to approximately 1,400 users, including journalists, human rights activists, and other members of civil society. WhatsApp seeks damages and a court ruling to prevent NSO Group from targeting its users again.

NSO Group has maintained its stance that it sells its tools exclusively to vetted government and law enforcement agencies.