NSO Group’s legal problems have deepened after a US appeals court thoroughly rejected the Israeli spyware company’s claim that it ought to be protected under sovereign immunity laws, in a high-profile case involving WhatsApp. The decision on Monday by the US court of appeals for the ninth circuit means that WhatsApp can proceed with its lawsuit against NSO over allegations that its spyware was used to hack 1,400 users of the app. It also means that the Israeli company will probably have to respond to discovery requirements as the case moves forward. That could lead to new disclosures about who NSO’s government clients are, how its technology works, and the process that is used to deploy its signature spyware, called Pegasus, attacks against mobile phone users. Once deployed, the user of the spyware can take over complete control of a person’s phone, accessing messages, intercepting phone calls and using the phone as a remote listening device. WhatsApp accused NSO of sending malware to 1,400 of its users over WhatsApp’s servers in 2019. The company has said that about 100 of the individuals who were targeted were members of civil society, including journalists and activists. In a recent interview with the Guardian, WhatsApp’s chief executive, Will Cathcart, said senior government officials around the world – including individuals in high national security positions who are “allies of the US” – were also targeted in the attack. The Guardian has previously reported that, among those whose phones were targeted were Rwandan dissidents in the UK and Europe, Moroccan journalists, members of the clergy in Togo and pro-Catalan independence politicians in Spain. NSO has said that even if WhatsApp’s allegations were true, it was acting as a “foreign agent” when its spyware was deployed against WhatsApp users, because its software is used by foreign governments who are meant to use its spyware to fight crime. In effect, it sought the kind of protection that a foreign government would receive in a US court. But that argument was rejected. The company has also said that it does not have information about how its client – which in the past have included Saudi Arabia and Mexico – use its spyware or who its clients target. But in what it called an “easy case”, the ninth circuit agreed with a lower US court and said NSO was not entitled to the protection of a foreign sovereign in this case. “And that is the end of our task,” the court said. NSO could appeal the decision to the US supreme court, but it is unclear whether the high court would take the case – or whether it would rule in NSO’s favour. The decision was praised by WhatsApp, whose spokesman, Carl Woog, called the decision “an important step in holding NSO accountable for its attacks against journalists, human rights defenders, and government leaders”. He added: “The spyware industry must be prevented from undermining the privacy and security of people across the world. We are grateful for the support from privacy and human rights NGOs and technology companies.” The case is far from over. Now the court will hear arguments about whether NSO ought to be held responsible for the attacks. For NSO, it was the second significant blow to the company in days after the Biden administration on Friday revealed it had put NSO on a US commerce department blacklist. The decision reflected a finding that NSO acted contrary to US foreign policy and national security. NSO has said it would challenge the ruling. The company did not immediately respond to the Guardian’s request for comment on the court ruling.