Commercial spyware is an industry, not a product

Summary

• In May 2025 a federal jury in California awarded WhatsApp and Meta damages against NSO Group, the maker of Pegasus. In October 2025 the judge cut the punitive part to about $4 million and ordered a permanent injunction that covers WhatsApp only.
• NSO is one seller among many. Google's Threat Analysis Group says it tracks around 40 commercial surveillance vendors, and the UK's National Cyber Security Centre says at least 80 countries bought commercial intrusion software in a decade.
• U.S. measures (Entity List, Treasury sanctions, Executive Order 14093) raise a seller's costs. They have not removed the market. Sellers change owners, names and corporate shells, and one sanctions step was partly reversed in December 2025.
• A seller's public claim, "only vetted governments, only serious crime", is a claim. Court findings and independent researcher reports are the record, and they sometimes differ from it.
• For a phone, the honest position is narrow. A published indicator that matches is strong. A clean result from one tool is weak. An examiner can rarely name the seller or the customer from one device.

One case that shows the business

In October 2019 WhatsApp and its parent company Meta sued NSO Group in the U.S. District Court for the Northern District of California. The complaint concerned an attack in April and May 2019 on more than 1,400 WhatsApp users. On 20 December 2024 Judge Phyllis Hamilton granted summary judgment to WhatsApp and Meta on all claims, finding NSO liable under the federal Computer Fraud and Abuse Act, California's computer fraud statute and WhatsApp's terms of service. Figure 1 shows the dates.

After the case went to a jury, the verdict came on 6 May 2025: $444,719 in compensatory damages and $167,254,000 in punitive damages. The Record reports that NSO executives acknowledged Pegasus can be installed through instant messaging, browser and operating-system routes and can compromise both iOS and Android devices, and that NSO could not tell the court what its customers aimed to do with it. NSO sells only to government customers, according to the company.

On 17 October 2025 the judge cut the punitive award to a little over $4 million. The reporting says she capped it at nine times the compensatory award, because the court did not find enough basis to call the conduct "particularly egregious". She also ordered a permanent injunction. NSO may not hack WhatsApp, reverse engineer it or create new WhatsApp accounts, and must destroy any WhatsApp source code it holds. The order covers WhatsApp, not other Meta products, and does not reach NSO's customers. NSO called the cut a step in the right direction, said the remaining sum was still disproportionately high, and said it denies wrongdoing and is not responsible for how customers use its products.

That is a real result. Its limit is also clear: the order stops one seller from attacking one service. The business, the product and the buyers were outside it.

A market with many sellers

Pegasus is often used as a word for all phone spyware sold to governments. It is one product from one seller. Google's Threat Analysis Group wrote in February 2024 that it actively tracks around 40 commercial surveillance vendors, and that they are behind about half of the known zero-day exploits aimed at Google products and Android devices. It describes what they sell as a bundle: an exploit chain, the spyware itself and the infrastructure to collect the data. The UK's National Cyber Security Centre (NCSC) assessed in April 2023 that over the previous decade at least 80 countries had bought commercial intrusion software, and that irresponsible use was almost certainly happening at scale, with thousands of people targeted each year.

Both sources also say the opposite thing that matters for ordinary readers: this is aimed at a small number of people at a time, mostly journalists, human rights defenders, dissidents and opposition politicians. Apple says the vast majority of its users will never be targeted by such attacks. Figure 2 lists five sellers that appear repeatedly in the public record, with one checkable fact each. It is a sample, not a ranking, and the facts are about the public record, not about every product or customer.

What U.S. rules do, and what they do not

Three U.S. tools are in play, and each does a different thing.

• The Entity List (Commerce Department). On 3 November 2021 Commerce added NSO Group and Candiru, with a Russian and a Singaporean firm, saying the first two supplied spyware that foreign governments used to target officials, journalists, businesspeople, activists, academics and embassy staff. On 18 July 2023 it added Intellexa and Cytrox entities, citing the trafficking of cyber exploits used to get into information systems. Listing means U.S. suppliers need a license to send items to the firm. NSO said it was dismayed and would seek reversal; TechCrunch reports it sought removal as recently as May 2025.
• Treasury sanctions. On 5 March 2024 Treasury sanctioned two individuals and five entities linked to Intellexa, saying Predator was deployed by foreign actors to surveil U.S. government officials and has also been used against journalists and policy experts. A second round followed in September 2024. On 30 December 2025 three individuals, Merom Harpaz, Andrea Gambazzi and Sara Hamou, were removed from the list, and the notice gave no reason.
• Executive Order 14093 (27 March 2023). It sets U.S. government policy: federal agencies are not to make operational use of commercial spyware that poses significant counterintelligence or security risks, or significant risks of improper use by a foreign government or person. It governs government use. It does not regulate private sales abroad. We did not check whether it has been amended since, so read the current text before relying on it.

Our reading, not a finding of any source: these tools raise a seller's cost and limit access to U.S. technology and money, but they act on sellers one at a time. The demand that created the market, governments wanting capability they cannot build themselves, is untouched, and a delisting shows that the pressure itself can move.

When one seller falls

The public record shows several things happening after trouble, and only some are closures.

• Closing. In April 2023 Israeli outlets reported that QuaDream was winding down, days after Microsoft and Citizen Lab published reports on its Reign spyware. The sources we read do not include a confirmation from the company.
• Changing hands. On 10 October 2025 NSO told TechCrunch that a U.S. investment group had acquired controlling ownership for tens of millions of dollars. NSO would not name the investors or the amount, and said its Israeli oversight and operations were unchanged. A report naming a specific investor came from Calcalist and was not confirmed by NSO.
• Changing names and shells. Amnesty's Security Lab, in its December 2025 report with media partners, says Predator has been rebranded several times and marketed as Helios, Nova, Green Arrow and Red Arrow. Recorded Future's Insikt Group describes a web of shell and front companies across several jurisdictions, in language that is often hedged, and assesses that sanctioned firms are splitting along geopolitical lines, some seeking legitimacy through acquisitions and others moving to places with weaker oversight. Amnesty also reports that a lawyer for Tal Dilian, one of the people Treasury sanctioned in March 2024, says he has committed no crime and operated no cyber system in Greece or anywhere else.
• Continuing. Citizen Lab reported in June 2025 forensic evidence that Paragon's Graphite spyware was used against two journalists' iPhones, using a zero-click iMessage route that Apple fixed in iOS 18.3.1 (CVE-2025-43200). Italy's parliamentary intelligence oversight committee acknowledged government use of Graphite against two people, according to Citizen Lab, and said it could not determine who targeted a third person, an editor who had been notified by WhatsApp. Citizen Lab itself could not confirm infection on that editor's phone.

What sellers say and what the record shows

Sellers in this market describe their customers in similar terms: governments, vetted, for terrorism and serious crime. Paragon, according to Citizen Lab, says it sells only to governments that respect fundamental rights. NSO says it sells only to government agencies. These are statements by the sellers. They are not findings.

The record adds detail that a reader can weigh. In the WhatsApp case the judge, before the jury phase, barred NSO from presenting evidence about government use of Pegasus against terrorists and criminals, and criticized NSO for saying it helps customers fight terrorism while disclaiming responsibility for how they use the tool, as The Record reports. In the Intellexa leaks, Amnesty reports that Intellexa kept the ability to access at least some customer systems remotely, and also says it cannot conclude this was true for all customers or at all times. NCSC says some states have almost certainly used such tools irresponsibly against journalists, activists, dissidents and foreign officials. None of this says every sale was misused. It says the sellers' own description is not enough to settle the question, and independent evidence is where it gets settled.

What this means for a phone

Who is at risk. Apple describes this class of attack as vastly more sophisticated than ordinary criminal activity and aimed at a very small number of people, often journalists, activists, politicians and diplomats. If you are one of them, or your work touches one of them, the risk is real. If you are not, other threats are far more likely, and your own phone-security basics matter more than this article.

Notifications. Apple sends threat notifications to users it believes were individually targeted. It calls them high-confidence, says its investigations can never reach absolute certainty and that it will not say what triggered one. You can check a notice by signing in at account.apple.com yourself, not through a link. Apple recommends Lockdown Mode for notified users, keeping devices updated and getting expert help, and names the Digital Security Helpline run by the nonprofit Access Now. WhatsApp also notified accounts it believed were targeted, according to Citizen Lab.

Tools and their limits. The Mobile Verification Toolkit, released by Amnesty's Security Lab in July 2021 alongside its Pegasus report, is described by its own documentation as a tool for the consensual forensic analysis of Android and iOS devices. Citizen Lab warns that Android logs can be sporadic, so a missing indicator does not show a device was clean, and in one case said relevant logs might not have been captured or might have been overwritten. For U.S. officials and others in senior government, military and political roles, CISA publishes mobile communications guidance, last revised 13 March 2026.

What an examiner can and cannot conclude

An examiner works from what the device and its backups still hold. Researchers who confirm this spyware do it with indicators drawn from published research, from infrastructure and from records on the phone, and they report a confidence level with each finding. Figure 3 sets out what three common situations support.

Two cautions follow. First, naming the seller is specialist work done from infrastructure and cross-case patterns, and even Citizen Lab said in one Paragon case that it could not yet establish a conclusive technical link, and does not name the customer. A single phone examination rarely settles that. Second, an empty result licenses a statement about the store you read, not about the person's history. The Lab's report on absence claims sets out why: a claim that nothing happened needs a store that could have recorded it (LAB-TR-0034).

A practical note from the Lab, not from the sources: if a notification arrives, keep it, keep the phone as it is, and ask a qualified person whether to preserve evidence before any reset, because a reset removes traces.

What this article does not claim

Sources

Every number and claim, and where it comes from. Pages were read on 2026-11-08. Where a primary court order was not available to the Lab's tools, the claim is cited to the outlet that reported it. LAB-TR-0034 is a Lab Technical Report available on this site, with no DOI yet (LAB-TR-0034).

Version history and corrections

Corrections log

No corrections have been published for this article. Corrections to any article are listed on Corrections, with the version they apply to.

Related