In a letter, WhatsApp says 121 users in India were targeted with NSO spyware; 22 of the alleged targets were activists, journalists, and civil rights lawyers
Recent revelations in India show that the threat from the company's spyware to activists and journalists isn't limited to autocratic regimes.
Context & Ripple Effects
This letter lands one week after WhatsApp filed its lawsuit against NSO Group, converting what had been an internal investigation into public litigation — and ten days after sources reported that senior government and military officials in at least 20 countries were among the malware's known targets. By naming 121 Indian targets in writing, WhatsApp is attaching a specific country count to the attack enabled by the vulnerability in its own call function, patched earlier in the year.
The significance is political: the description's framing that spyware threats 'aren't limited to autocratic regimes' puts India — a democracy and one of WhatsApp's largest markets — in the same column as the client states implied in the broader targeting coverage. It also sets up the forensic work that followed, when phones of 22 people on the target list were later examined and 7 were confirmed infected, including opposition politicians.
First-order effects
- The 22 named activists, journalists, and civil rights lawyers now have documented grounds to demand answers from both NSO Group and their own government about who commissioned the targeting.
- WhatsApp strengthens its lawsuit's evidence base: a written tally of 121 Indian targets gives the legal action against NSO a concrete, country-level victim roster rather than a global estimate.
Second-order effects
- NSO's government-client model faces exposure risk on two fronts — this disclosure plus the reported targeting of officials across 20 countries makes each new national count a reputational liability for the buying governments, not just the vendor.
- Platform operators like WhatsApp become de facto spyware watchdogs: their breach investigations and notifications are emerging as the primary source of attribution, forcing surveillance vendors to treat consumer-app companies as adversaries rather than neutral infrastructure.
Third-order effects
- If the pattern holds — disclosure, litigation, then forensic confirmation — the commercial spyware industry moves toward accountability through private lawsuits rather than regulation, a path later validated when court documents tied to WhatsApp's case established that Pegasus reached 1,223 users across 51 countries.
- Democratic governments purchasing such tools lose plausible deniability by association, raising the prospect that domestic targeting of civil society becomes a distinct regulatory and export-control question separate from counterterrorism use cases.
The trend: Commercial spyware is being forced into the open by platform-level disclosures and litigation, with democracies increasingly implicated as customers alongside autocracies.