Judge Orders NSO Group to Surrender Pegasus Source Code to Meta

A US Judge ordered the infamous spyware developer and vendor NSO Group to turn over its source code to Meta as part of an almost four-year lawsuit.

The  NSO Group is known particularly for its Pegasus spyware used against iOS users, but it's also developing a dedicated solution targeting Android. These spyware solutions, though, would not be as effective if it weren’t for the zero-click vulnerabilities the Israeli company also uncovered.

Meta sued NSO in 2019 after the American company discovered that a zero-day WhatsApp vulnerability was used to deploy the spyware. According to a Guardian report, the NSO's spyware was allegedly used against 1,400 people in the course of just two weeks.

"The court rejects defendants' argument that their production should be limited to the installation layer of the alleged spyware, and instead concludes that defendants must produce information concerning the full functionality of the relevant spyware," said Judge Phyllis Hamilton.

"Defendants' proposal of producing information showing the functionality of only the installation layer of the relevant spyware would not allow plaintiffs to understand how the relevant spyware performs the functions of accessing and extracting data, and thus, the court directs defendants to provide information sufficient to show the full functionality of all relevant spyware," the court added.

The lawsuit doesn't compel NSO to reveal the identities of  the clients who purchased the spyware, but turning over the source code would allow Meta to better safeguard in the future. The suit is still ongoing, as this was only an order from the judge during the trial. The trial is scheduled to start on March 3, 2025.

Meta is not the only company suing NSO. Apple also hit the Israeli company with a lawsuit, alleging that its Pegasus spyware enabled extensive state-sponsored hacking of its iOS devices.