The spyware industry in the courts: injunctions, entity lists and sanctions

Four kinds of statement

A research finding is made by a laboratory or a vendor’s threat team. An allegation is made by a party to a dispute. A court ruling is made by a court. A government designation is made by an agency. We label each.

One backdrop figure from the research side: Google’s threat intelligence group counted 90 zero-days exploited in the wild in 2025 and said that, for the first time since it began tracking, it attributed more exploitation to commercial surveillance vendors than to traditional state-sponsored espionage groups[S14]. That is a finding, not a ruling. It explains why the other three kinds of statement have followed.

A court ruling and an injunction

In December 2024 a US federal district court in California found NSO Group liable for the 2019 attacks on WhatsApp users. In May 2025 a jury awarded about $444,719 in compensatory damages and about $167 million in punitive damages [S1][S2]. On 17 October 2025 the court issued a permanent injunction and cut the punitive damages to about $4 million in total [S1][S2].

The injunction is narrow. NSO may not reverse-engineer WhatsApp or create WhatsApp accounts to carry out attacks, and must delete WhatsApp code it holds. It does not cover NSO’s customers or other Meta products [S1][S2]. NSO has said the injunction would put its business at risk, according to press accounts, and has appealed to the Ninth Circuit (No. 25-7380). A stay was denied and briefing finished on 1 July 2026; we found no hearing date [S3][S5].

On 8 June 2026, according to CyberScoop, Meta reported a contempt complaint to the court alleging an NSO-linked spearphishing campaign aimed at pulling users off WhatsApp. That is an allegation by Meta, not a finding. NSO did not respond to the outlet’s requests for comment[S4].

The entity list and the sanctions

The Commerce Department’s Entity List restricts US exports to the entities on it. NSO and Candiru were added in November 2021[S8]. Intellexa and Cytrox followed in July 2023[S9]. The Treasury Department sanctioned the Intellexa consortium and its executives in 2024. On 30 December 2025 it removed three individuals from the sanctions list. Treasury told Reuters, as The Hacker News reported, that this followed a routine reconsideration after they had "demonstrated measures to separate themselves" from the consortium. Access Now criticized the decision[S10]. An individual who has been delisted is not described as sanctioned.

NSO remained on the Entity List in the latest sources we read. TechCrunch reported that a group of US investors acquired NSO in 2025 and that the company has lobbied for removal. It also reported that NSO’s January 2026 transparency report was criticized by Access Now and Citizen Lab as unverifiable[S6]. A later tracker, dated August 2026, still described it as listed[S7]. We found no delisting. The Federal Register is the authority and should be checked on the day.

A voluntary code for states

The UK- and France-led Pall Mall Process produced a Code of Practice for States on commercial cyber-intrusion capabilities, adopted in Paris in April 2025. It is voluntary and non-binding, and sets out principles of accountability, precision, oversight and transparency[S11]. Industry guidelines are being drafted, with publication expected in November 2026; civil-society groups made a joint submission in September 2026 pressing for clear standards on sales and servicing[S12]. Sources differ on how many governments have signed, so we give no count.

In 2023 the US adopted Executive Order 14093, which restricts operational use of commercial spyware by US agencies where it poses counterintelligence or security risks[S13]. We did not verify its present status and say only that it was adopted in 2023.

What the law does not change

An injunction against one company’s conduct toward one app does not close the routes other vendors use. An export restriction does not remove software that already exists. A voluntary code binds no one who has not chosen to be bound. In Europe, civil-society groups said in July 2026 that the Commission and Parliament had not delivered a meaningful response to the 2023 recommendations of the Parliament’s spyware inquiry; the 2021 Dual-Use Regulation, which covers cyber-surveillance exports, is under review, and we found no EU spyware regulation[S15].

Our assessment

Our assessment is that the legal record is moving faster than the technical one is changing. Each instrument acts on a company, an export or a state’s conduct. None acts on a phone. The technical exposure of a phone, a flaw reachable by a link, a message or a cable, is the same the day after a ruling as the day before. That is why updates, Lockdown Mode and a careful examination remain the practical protections whatever the courts decide.

We also note how quickly statuses change. Between May and December 2025 a damages award fell from about $167 million to about $4 million, an injunction was issued and three people left a sanctions list[S1][S2][S10]; in 2026 a contempt claim was filed[S4]. A figure quoted a year ago may no longer be true.

What the Lab is watching

We are watching the Ninth Circuit docket for a hearing date or ruling, the court record on Meta’s contempt complaint[S4], the Federal Register for any change to NSO’s listing, the Pall Mall industry guidelines due in November 2026, and the status of Executive Order 14093.

What this means for examiners

Report each statement with its kind and its date. Write "indicators consistent with" rather than "infected by" a named vendor unless a primary report ties the artifact to that family. Do not describe a state as a customer of a vendor on the strength of a rumor, and do not describe a delisted person as sanctioned. A phone’s owner needs nothing different from before: update promptly and consider Lockdown Mode if at risk.

Dated status table

None of these was re-checked on the publication day; each should be.