NSO Group is conducting active spear-phishing campaigns through the WhatsApp platform in defiance of a U.S. federal court injunction, using fake accounts and malicious redirect links to deliver Pegasus spyware to high-value targets on iOS and Android. Meta has published three IOC domains and filed a contempt motion. Organizations with executives, lawyers, journalists, or government liaisons using WhatsApp for business communication face immediate mobile threat exposure; no software patch exists — mitigations are behavioral, network-layer, and MDM policy controls.