In a stunning disclosure during a recent U.S. court hearing, an attorney representing Israeli spyware maker NSO Group publicly named Mexico, Saudi Arabia, and Uzbekistan as clients involved in the controversial 2019 Pegasus spyware campaign that targeted more than 1,200 WhatsApp users.

The revelation marks the first time that NSO Group, which has long refused to confirm the identities of its clients, has named any of its government customers on record.

Speaking during a hearing in the high-profile lawsuit filed by Meta-owned WhatsApp, NSO attorney Joe Akrotirianakis disclosed that the three governments were among the operators behind the hacking spree, which exploited a WhatsApp vulnerability to deliver Pegasus spyware between April and May 2019. A transcript of the hearing, obtained by TechCrunch, details the exchange.

“There’s at least eight customers whose names are part of the discovery in this case,” Akrotirianakis said, naming only the three.

A First Public Admission

NSO’s legal team had previously resisted naming clients, citing confidentiality and national security restrictions. The company has repeatedly claimed it only sells Pegasus to vetted government clients for lawful surveillance of criminals and terrorists.

However, this legal maneuver may be shifting as the case progresses toward trial. WhatsApp is seeking damages and a permanent injunction against NSO Group, accusing it of facilitating unlawful surveillance of journalists, human rights defenders, lawyers, and activists. The lawsuit claims that around 1,400 individuals were targeted via the app.

Citizen Lab, which partnered with WhatsApp to identify victims, has long tracked Pegasus abuse across the globe, documenting cases of spyware being used far beyond terrorism prevention — including surveillance of political dissidents, opposition leaders, and even children of journalists.

Pegasus Targets Spanned 51 Countries

A newly unsealed court document lists the countries where 1,223 WhatsApp users affected by the 2019 attack were based — a list that includes India, Bahrain, Morocco, Spain, the UK, and the U.S. Notably, Saudi Arabia — named in court — does not appear on that list, possibly because, as Akrotirianakis suggested, Pegasus licenses apply by territory, but not necessarily by the location of the target.

This echoes previous Citizen Lab findings, including a 2017 report alleging Mexican government operatives used Pegasus to target individuals while they were physically in the United States.

Legal Gray Zones and Mounting Pressure

The court is now wrestling with the murky reality of NSO’s client operations. In a pre-trial order issued Tuesday, the judge noted:

“The evidentiary record is opaque as to which of [NSO’s] clients were responsible for the attacks… [WhatsApp] was unable to discover evidence about whether screening procedures were followed.”

Though NSO has stated that four governments are named in discovery materials, the judge said the company has not officially confirmed any as its customers — aside from the statements made during last week’s hearing.

NSO spokesperson Gil Lainer declined to comment when approached by TechCrunch, but did not dispute that Mexico, Saudi Arabia, and Uzbekistan were customers at the time. WhatsApp spokesperson Zade Alsaway said the company looks forward to the trial to “secure an injunction against NSO to protect WhatsApp and people’s private communication.”

A Broader Pattern of Abuse

This lawsuit is one of several escalating legal and political challenges facing NSO Group, whose spyware has become a global symbol of unchecked surveillance. International watchdogs like Amnesty International and Citizen Lab have tied Pegasus to a wide array of abuses — from the hacking of Catalan politicians in Spain to the surveillance of Jamal Khashoggi’s associates in Saudi Arabia.

As NSO’s legal defenses begin to crack, the world is getting a clearer view into how and where the world’s most infamous surveillance tool has been deployed — and by whom.