Eight things we learned from WhatsApp vs. NSO Group spyware lawsuit

A jury ordered NSO Group to pay over $167 million in damages to WhatsApp following a five-year legal battle over the hacking of 1,400 users via a vulnerability in WhatsApp's audio-calling feature. The trial revealed details about NSO's spyware tactics, including zero-click attacks and continued targeting of WhatsApp users even after the lawsuit was filed, and also exposed the company's precarious financial state, with significant losses and dwindling cash reserves despite charging millions for its Pegasus spyware.

Analysis

Meta-owned WhatsApp secured a significant legal victory with a jury ordering NSO Group to pay over $167 million in damages, concluding a five-year lawsuit initiated after NSO hacked 1,400 WhatsApp users via a zero-click exploit exploiting the app's audio-calling functionality. Trial testimonies revealed NSO Group's methods, including a dedicated "WhatsApp Installation Server" for delivering malicious messages, and the continued targeting of WhatsApp users with exploits codenamed "Erised," "Eden," and "Heaven" (collectively "Hummingbird") from late 2019 to May 2020, even after the lawsuit was filed. NSO Group also admitted to targeting a U.S. phone number as a test for the FBI, a deviation from its stated policy. Despite charging European government clients a "standard price" of $7 million (plus $1 million for "covert vectors") and substantially more to other nations like Saudi Arabia (reportedly $55 million) and Mexico (reportedly $61 million), NSO Group faces severe financial distress. The company disclosed losses of $9 million in 2023 and $12 million in 2024, with bank balances falling from $8.8 million to $5.1 million respectively, set against a monthly cash burn of approximately $10 million, largely for salaries of its 350-380 employees. Research and development expenses were $52 million in 2023 and $59 million in 2024. NSO's CEO, Yaron Shohat, described the company as "struggling to keep our head above water" and expressed doubt about its ability to pay any damages, highlighting the precarious financial viability of the spyware firm, which coincidentally shares its Herzliya headquarters building with Apple, whose products are frequently targeted by Pegasus.

Key Decisions for Investors

• For Meta Platforms (META), this legal victory, carrying a $167 million damages award, represents a positive reputational outcome reinforcing its commitment to user security and potentially deterring similar cyberattacks, although the financial sum itself is unlikely to be material to Meta's overall financial results.
• Investors in Apple (AAPL) should consider the persistent cybersecurity threat posed by sophisticated spyware like Pegasus to its ecosystem, as demonstrated by NSO Group's capabilities; NSO's specific financial difficulties do not negate this broader, ongoing risk factor for Apple's products and user trust.
• The acute financial distress of NSO Group, compounded by substantial legal damages, underscores significant operational and solvency risks inherent in the controversial spyware sector, prompting caution and a potential re-evaluation of the investment viability and ethical considerations for entities operating in or funding similar technologies.