In May 2019, WhatsApp identified and fixed a loophole that enabled cybercriminals to install spyware on smartphones just by ringing the victim’s phone. The video calling system was exploited in particular and it did not require users to answer the calls.
  
Around 1,400 users were affected, including journalists and human rights defendants in at least 20 countries. Later in October, the attack was blamed on the Israeli spyware developer NSO Group, also known as Q Cyber Technologies.
 
Facebook, which owns WhatsApp, is now saying that US-based servers were used by the NSO Group to target WhatsApp users using signature Pegasus software.

Facebook also challenges claims that the NSO Group works with foreign governments

The social media company says that Los Angeles-based hosting service QuadraNet’s server was used over 700 times during the attack to install malware on the devices of WhatsApp users between April and May 2019. The spyware developer is also accused of using an Amazon-hosted remote server to launch attacks.
 
When Facebook sued the surveillance firm in October, the NSO group denied the allegations, claiming that its technology is only sold to government clients.
 
However, now that Facebook is accusing it of using US-based servers to stage attacks, it could weaken the software developer’s case. That’s because NSO had earlier said that it couldn’t run operations in the US.
 
Additionally, Facebook has also challenged NSO Group’s claim that the case should be dissolved as its government clientele grants it immunity and also because of jurisdictional technicalities. Facebook says the company hasn’t named even one country it sold software to and it has provided no proof, such as a document, which proves its role was only operational. This could have helped absolve the spyware maker of the action of its clients. Basically, the NSO Group wants to get off scot-free just because governments seemingly use its products and Facebook isn’t buying that.
 
The NSO Group, on the other hand, is still standing its ground. The company has reiterated that the Pegasus software doesn’t work in the US.