Facebook sues Israeli cybersecurity company claiming it hacked WhatsApp users

Facebook filed a suit in a Federal court against an Israeli cybersecurity company NSO Group claiming that it hacked WhatsApp users earlier this year. The suit amounted to a new legal front in attempts to curb the abuses of the burgeoning global surveillance industry.

Facebook has alleged that NSO Group used WhatsApp servers to spread malware to 1,400 mobile phones in an attempt to target journalists, diplomats, human rights activists, senior government officials and other parties. According to the lawsuit, since the malware was unable to crack WhatsApp encryption, it instead infected the customers’ phones, thereby giving NSO access to messages after they were decrypted on the receivers’ devices.

The malware was capable of initiating a powerful form of spying that included the ability to intercept communications, steal photos and other forms of data, activate microphones, track the locations of targets and more, said people familiar with NSO technology.

Facebook also named Q Cyber, a company affiliated with NSO, as a second defendant in the case.

Apparently, NSO used its flagship software, “Pegasus” to access messages sent via WhatsApp and on platforms such as Apple’s iMessage, Microsoft’s Skype, Telegram, WeChat and Facebook Messenger.

Facebook has alleged that NSO Group workers created WhatAapp accounts to send “malware components” to devices of those targeted, including by initiating calls to “secretly inject malicious code.” NSO was thereby able to take control of the targeted individuals’ smart phones, according to the suit, using computers they controlled. According to the lawsuit, the targets were identified in 20 countries.

This is the first lawsuit targeting a malware manufacturer on behalf of an encrypted messaging service said people involved in the suit and the underlying research.

According to WhatsApp, it stopped a sophisticated attack using NSO malicious software in May and subsequently alerted 1,400 users that they may have been affected. Citizen Lab has been researching the use of hacking technologies and their manufacturers for quite sometime now. At least 100 victims have now been identified.

This is the first time that an encrypted messaging provider is taking legal action against a private entity that has carried out this type of attack against its users.