WhatsApp Says It Disrupted Phishing Attempts Linked to NSO Group
Summary
Meta says WhatsApp disrupted alleged NSO-linked phishing attempts after user reports, removed test accounts and groups, and identified malicious-link lures. WhatsApp urged users to update their apps and operating systems.
Key points
- Meta says WhatsApp investigated user reports and disrupted social-engineering attempts it linked to NSO Group.
- The reported lures sought to send targets to external websites through malicious links, resembling earlier one-click phishing campaigns.
- Meta says it removed test accounts and groups created for the operation.
- Meta listed ikhwancast[.]com, ghazacast[.]com, and fr24cast[.]com as indicators associated with the activity.
- WhatsApp urged users to update apps and operating systems; the article also cites Android Advanced Protection and iOS Lockdown Mode as options to reduce exposure.
Article Details
- Event Type
- Disruption of spear-phishing and social-engineering campaigns linked to NSO Group
- Impact
- WhatsApp says it disrupted the attempts after investigating user reports and removed test accounts and groups created for the operation. The reported lures used malicious links to direct targets to external websites. The article does not report confirmed successful infections from these campaigns.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | fr24cast[.]com | Listed by Meta as an indicator of compromise for the detected attacks. |
| DOMAIN | ghazacast[.]com | Listed by Meta as an indicator of compromise for the detected attacks. |
| DOMAIN | ikhwancast[.]com | Listed by Meta as an indicator of compromise for the detected attacks. |
MITRE ATT&CK
Threat Actors
Malware
Vendors
MetaMeta says the activity involved test accounts, groups, and domains such as ikhwancast[.]com, ghazacast[.]com, and fr24cast[.]com, despite prior court action and U.S.NSO GroupWhatsApp says it disrupted spear-phishing and social engineering campaigns linked to NSO Group after user reports, including attempts to lure targets to external sites with malicious links.