Israeli indictment says an employee allegedly stole source code of NSO Group's powerful smartphone hacking tools before attempting to sell it for $50M
NSO sells its potent iPhone malware to governments, including Mexico and the United Arabs Emirates. But according to a newly released indictment …
Context & Ripple Effects
The indictment lands a year after a hacker made off with 900GB from Cellebrite, Israel's other phone-breaking firm, establishing that the country's spyware shops keep their most valuable asset — working exploit and tooling code — in places insiders and outsiders can reach. For NSO, whose iPhone malware is sold to governments including Mexico and the UAE, the alleged thief was an employee, not an outsider.
The episode also feeds a paper trail NSO is already fighting on other fronts: court documents in lawsuits against the company allegedly show it snooping on calls to close sales, and it would later tell buyers its spyware can read authentication tokens to reach victims' iCloud data. A $50M asking price for the source code puts a market value on exactly the capability governments were paying for.
First-order effects
- NSO's government clients — Mexico and the UAE among them — now have to assess whether stolen tooling code exposes their own operations or could be resold to rival services, while NSO itself faces the cost of securing a codebase an insider has already walked out the door with.
Second-order effects
- Buyers of commercial spyware gain leverage to demand provenance and security assurances before paying, and the incident hands ammunition to the US investigators who, per later reporting, had been probing NSO since 2017 over hacks touching American residents and companies.
Third-order effects
- If insider theft keeps hitting Israel's surveillance vendors — Cellebrite's breach, then this — the industry's structure becomes the vulnerability: a handful of small firms concentrating nation-state capability in portable source code means one disgruntled engineer can redistribute offensive power across borders faster than any export regime can track.
The trend: Commercial spyware is consolidating nation-state-grade hacking into a few small firms' source code, making insider theft — not state adversaries — the fastest way that capability proliferates.