On May 6, WhatsApp won a major victory over the NSO group, with ry umpire ordering the infamous spyware manufacturer to pay more than $167 million in damages to the meta-owned company.
The ruling concluded a legal battle that lasted over five years. This began in October 2019 when WhatsApp accused NSO groups of hacking over 1,400 users by exploiting a vulnerability in the audio call feature of chat apps.
The verdict came after a week of ju trial featuring several testimonies, including NSO group CEO Yaron Shohat and WhatsApp employees who investigated in response to the case.
Even before the trial began, NSO groups were unearthing several revelations, including the abuse of Pegasus spyware, the locations of 10 government customers, 1,223 victims of spyware campaigns, and the names of three customers from the spyware maker.
TechCrunch read more than 1,000 pages of court records for trial hearings. Below I highlighted the most interesting facts and revelations.
New testimony explained how WhatsApp attacks worked
The zero-click attack meant that spyware didn't require interaction from the target, and “it worked by making fake WhatsApp calls to the target,” WhatsApp lawyer Antonio Perez said during the trial. The lawyer explained that the NSO group has built what is called “WhatsApp Installation Server.” This is a special machine designed to mimic real messages across WhatsApp's infrastructure and send malicious messages.
“When we received these messages trigger the user's phone and reach out to a third server to download Pegasus spyware. All we needed to do is make this happen,” Perez said.
Tamil Gazneli, Vice President of Research and Development for NSO Group, testified that “any zero-click solution is an important milestone for Pegasus.”
The NSO has confirmed that it continues to target WhatsApp users after the lawsuit was filed
After the SPYware attack, WhatsApp filed a lawsuit against the NSO group in November 2019. Despite aggressive legal challenges, SPYware makers continued to target users of chat apps.
Gazneli said that “Erised,” the codename for one of the versions of WhatsApp Zero-Click Vector, was in use from late 2019 to May 2020.
The NSO confirms that it targeted US phone numbers as a test for the FBI
inquiry
Do you have more information about the NSO Group or other spyware companies? From unprocessed devices and networks, you can safely contact Lorenzo Franceschi-Bicchierai with a signal of +1 917 257 1382, via Telegram and Keybase @lorenzofb, or by email.
For years, NSO Group has argued that its spyware cannot be used against American phone numbers. In other words, it means a cell number that starts with a +1 country code.
In 2022, The New York Times first reported that the company “attacked” US mobile phones, but was part of the FBI test.
NSO Group lawyer Joe Akrotirianakis confirmed this and said Pegasus' “single exception” cannot target the number +1.
The FBI reportedly chose not to deploy Pegasus after its test.
How NSO government customers use Pegasus
NSO CEO Shohat explained that Pegasus' user interface for government customers does not provide the option to select the hacking method or technique to use for targets of interest, as “as long as the customer gets the intelligence they need, they don't care which vectors they use.”
In other words, it is the back-end Pegasus system that chooses hacking technology known as exploits for use every time spyware targets individuals.
The NSO says it employs hundreds of people
NSO Group CEO Yaron Shohat revealed small but notable details. The NSO Group and its parent company QCyber have a total of 350-380 employees. Approximately 50 of these employees work at QCyber.
NSO headquarters shares the same building as Apple.
An interesting coincidence, the NSO Group's headquarters in Herzliya, a suburb of Tel Aviv, Israel, is located in the same building as Apple, and its iPhone customers are also frequently targeted by NSO Pegasus Spyware. Shohat said the NSO occupy the top five floors, while Apple occupy the rest of the 14-storey building.
“We share the same elevator as we go up,” Shohat said in his testimony.
The fact that the NSO Group's headquarters is openly advertised is somewhat interesting in its own right. Other companies that develop spyware and zero-days, like Barcelona-based Bariston, which closed in February, have been in coworking spaces, claiming they are somewhere on their official website.
Pegasus Spyware costs millions of customers in Europe
In testimony, an NSO group employee revealed how much they charged European customers to access Pegasus Spyware between 2018 and 2020, saying the “standard price” was $7 million plus about $1 million, an additional “secret vector.”
These new details were included in court documents without the full context of testimony, but provide an idea of how often sophisticated spyware like Pegasus can cost government. Although not explicitly defined, “cover vector” can refer to stealth techniques used to plant spyware on target phones, such as zero-click exploits.
Spyware and zero-day prices vary depending on a number of factors. Customers are customers who charge more when selling to countries such as Saudi Arabia and the United Arab Emirates. The number of simultaneous targets that a customer can spy on at any time. Features add-ons such as the zero-click function.
All of these factors explain why European customers pay $7 million in 2019, but Saudi Arabia reportedly paid $55 million, while Mexico paid $61 million in a few years.
The NSO explains the miserable state of finances
During the trial, Shohat answered questions about the company's finances. Some of this was disclosed in deposit prior to trial. These details were filed in connection with damages due to WhatsApp by the spyware manufacturer.
According to Shohat and documents provided by NSO Group, Spyware Maker lost $9 million in 2023 and $12 million in 2024. The company has burned $8.8 million in bank accounts, $5.1 million in bank accounts and recently around $10 million, covering mostly its employees.
It was also revealed in both 2023 and 2024 that QCyber has around $3.2 million in banks.
During the trial, the NSO revealed a research and development unit responsible for finding vulnerabilities in software and figuring out how to exploit them – spent about $52 million in 2023 and $59 million in 2024.
Given these numbers, spyware manufacturers wanted to get away with little or no damage.
“To be honest, I don't think we can pay anything. We have a hard time keeping our heads above our heads,” Shohat said in his testimony. “We're going to prioritize costs to (the Chief Financial Officer) and make sure we have enough money to meet our commitments, and obviously every week.”
It was first published on May 10, 2025, with additional details updated.