The spyware was developed by the Israeli cyber intelligence company NSO Group, the Financial Times reported. According to the newspaper, the code could be transferred to a target’s device by calling the user and infecting the call whether or not the recipient answered the call. The vulnerability was used in an attempted attack on the phone of a UK-based attorney on 12 May. The lawyer, according to the report, is involved in a lawsuit against NSO brought by a group of Mexican journalists, government critics and a Saudi Arabian dissident.
“The attack has all the hallmarks of a private company reportedly that works with governments to deliver spyware that takes over the functions of mobile phone operating systems,” WhatsApp said in a statement. “We have briefed a number of human rights organizations to share the information we can and to work with them to notify civil society.”
WhatsApp said that the vulnerability was discovered this month and that the company quickly addressed the problem within its own infrastructure, publishing an update on Monday. It has also alerted US law enforcement to the exploit, and published a “CVE notice” to other cybersecurity experts alerting them to “common vulnerabilities and exposures”.
NSO Group has denied the allegations, telling the FT that it was investigating the WhatsApp attacks.
READ MORE: Sign of the Times: Run on UK Bank Triggered by a Rumour on WhatsApp
“Under no circumstances would NSO be involved in the operating or identifying of targets of its technology, which is solely operated by intelligence and law enforcement agencies,” NSO Group told the FT. “NSO would not, or could not, use its technology in its own right to target any person or organization, including this individual.”
