NSO Group

☆ pin

Reports

First seen

Jun 8, 2026

Last seen

Jul 1, 2026

Motivation

Espionage

Targeting

Victim regions

×2

United States×2

Victim country, only when stated. Corpus is predominantly English-language reporting, so US/EU coverage is overweighted relative to true victim distribution.

Top ATT&CK techniques

T1566 Phishing ×5T1598 Phishing for Information ×4T1204 User Execution ×2T1190 Exploit Public-Facing Application ×1T1005 Data from Local System ×1T1133 External Remote Services ×1T1486 Data Encrypted for Impact ×1T1110 Brute Force ×1T1078 Valid Accounts ×1T1041 Exfiltration Over C2 Channel ×1

Indicators

domain ×8cve ×4

Indicator values are available on Pro and via the API.

Associated CVEs

CVE-2026-11645 (exploited)CVE-2026-20230 (exploited)CVE-2026-28318 (exploited)CVE-2026-42897 (exploited)

Recent reports

High

CERT-EU Cyber Brief June 2026 – Multi-Sector Espionage, Ransomware, and Zero-Days

CERT-EU Threat IntelJul 1, 2026 High

WhatsApp disrupts NSO Group phishing campaigns targeting users

Bleeping ComputerJun 8, 2026 High

Meta accuses NSO Group of defying spyware injunction, files contempt of court complaint

CyberScoopJun 8, 2026 High

Meta Blocks NSO Group's WhatsApp Phishing Campaign, Files Contempt Order

The Hacker NewsJun 8, 2026 High

WhatsApp accuses NSO of spearphishing attacks violating court order

The Record (Recorded Future News)Jun 8, 2026

This page shows data on a 7-day delay. Free accounts get the full delayed feed; real-time reports, indicators, and the API start at $29/mo.