Meta Says It Blocked NSO-Linked WhatsApp Phishing Attempts, Seeks Contempt Order
Summary
Meta says it blocked spear-phishing attempts linked to NSO Group, removed related WhatsApp test accounts and groups, and is seeking a federal contempt order. It advises at-risk users to update apps and enable strict account settings.
Key points
- Meta said it detected and blocked spear-phishing attempts linked to NSO Group that sought to lure WhatsApp users to external websites.
- Meta said it removed test accounts and groups on WhatsApp that it linked to the activity.
- Meta is seeking a federal contempt order, alleging NSO Group violated a permanent injunction against targeting WhatsApp and its users.
- Meta listed fr24cast[.]com, ghazacast[.]com, and ikhwancast[.]com as domains linked to the activity.
- Meta recommends keeping apps and devices updated and reporting suspicious activity.
- For users at elevated risk, strict account settings include enabling two-step verification, disabling link previews, and limiting profile visibility and group additions.
Article Details
- Event Type
- Meta blocked spear-phishing attempts linked to NSO Group and is seeking a federal contempt order over alleged violations of an injunction protecting WhatsApp users.
- Impact
- Meta said it removed NSO Group-linked test accounts and groups and identified three malicious domains. The article reports no confirmed successful compromise from these attempts. Meta advised users to update apps and devices and recommended strict account settings for people at elevated risk.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | fr24cast[.]com | Domain Meta identified as malicious and linked to the reported NSO Group activity. |
| DOMAIN | ghazacast[.]com | Domain Meta identified as malicious and linked to the reported NSO Group activity. |
| DOMAIN | ikhwancast[.]com | Domain Meta identified as malicious and linked to the reported NSO Group activity. |
MITRE ATT&CK
Threat Actors
Malware
Vendors
MetaMeta said it blocked spear-phishing attempts linked to NSO Group and is seeking a federal contempt order over violations of a permanent injunction against targeting WhatsApp users.NSO GroupMeta said it blocked spear-phishing attempts linked to NSO Group and is seeking a federal contempt order over violations of a permanent injunction against targeting WhatsApp users.