In a rare courtroom revelation, a lawyer representing NSO Group—the controversial Israeli spyware company—has named the governments of Mexico, Saudi Arabia, and Uzbekistan as clients involved in the 2019 Pegasus spyware campaign that targeted over 1,200 WhatsApp users globally.
The disclosure came during a hearing last Thursday in the ongoing lawsuit filed by Meta-owned WhatsApp against NSO Group.
The lawsuit, first initiated in 2019, accuses NSO of exploiting a critical vulnerability in the WhatsApp platform to deploy its powerful surveillance tool, Pegasus, against approximately 1,400 users. Among the victims were human rights activists, journalists, and members of civil society, as identified in collaboration with the University of Toronto’s Citizen Lab.
Speaking in court, NSO’s legal counsel Joe Akrotirianakis acknowledged that “at least eight” countries appear in the lawsuit’s discovery materials as NSO customers, specifically naming Mexico, Saudi Arabia, and Uzbekistan. This marks the first time NSO Group has directly confirmed—or allowed confirmation—of any government clients, after years of refusing to do so publicly.
Interestingly, Saudi Arabia, though named in the courtroom, does not appear in a recently unsealed list of 51 countries where Pegasus victims were reportedly located. Legal experts suggest this could be due to Pegasus’s ability to target individuals beyond a government’s own borders—a tactic previously noted in cases involving Mexican authorities targeting journalists in the United States.
While NSO Group declined to comment, it did not dispute the countries named. WhatsApp spokesperson Zade Alsawah reaffirmed the platform’s commitment to pursuing justice: “We look forward to the upcoming trial to determine damages and secure an injunction against NSO to protect WhatsApp and users’ private communications.”
The case is now heading toward a trial phase, with wider implications for accountability in the global spyware industry. Observers say the outcome could set new legal benchmarks for tech platforms fighting against cyber surveillance abuses.