Make a title for this article (do not wrap in quotes or use semicolon or weird characters):

Israeli surveillance company NSO Group reportedly leveraged multiple zero-day exploits, including a previously unknown one dubbed "Erised," to exploit vulnerabilities in WhatsApp and deploy Pegasus spyware through zero-click attacks, even amidst ongoing litigation.

Pegasus is NSO Group's spyware suite, pitched as a surveillance tool for governments worldwide, offering extensive monitoring capabilities over compromised devices. By deploying the Pegasus agent on victims' mobile phones, NSO's clients could scrutinize activities and extract data from the affected devices.

According to court documents filed Thursday, first identified by Citizen Lab senior researcher John Scott Railton, as part of WhatsApp’s legal proceedings against NSO Group, the spyware developer crafted an exploit called ‘Heaven’ prior to April 2018. This exploit utilized a custom WhatsApp client known as the ‘WhatsApp Installation Server’ (or ‘WIS’), which could impersonate the official client to install the Pegasus spyware from an NSO-controlled server on target devices.

However, security updates released by WhatsApp in September and December 2018 cut off NSO's access to affected devices and their servers, effectively neutralizing the Heaven exploit.

By February 2019, NSO had allegedly developed a subsequent exploit called 'Eden', designed to circumvent the protections WhatsApp implemented in 2018. In May 2019, WhatsApp discovered that Eden was used in attacks on approximately 1,400 devices by NSO's clients.

NSO acknowledged in court that it created and sold the spyware mentioned in the legal complaint and that its zero-click installation method, known as 'Eden', was part of a suite of WhatsApp-based exploits collectively referred to as 'Hummingbird'.

In court documents, Tamir Gazneli, head of research and development at NSO, alongside other defendants, admitted to reverse-engineering WhatsApp’s code to create the WIS client, capable of sending malformed messages that official WhatsApp clients couldn’t. These actions enabled the implantation of Pegasus spyware on target devices, in violation of both federal and state laws and WhatsApp's Terms of Service.

After identifying the attacks, WhatsApp patched the Eden vulnerabilities and deactivated NSO’s WhatsApp accounts. Despite these efforts, court filings indicate that NSO developed another exploit, 'Erised', which utilized WhatsApp's relay servers for installing Pegasus spyware.

Court documents reveal that NSO continued deploying Erised for its clients, even after the lawsuit was initiated in October 2019, until further updates from WhatsApp blocked access after May 2020. Despite being questioned, NSO witnesses avoided confirming whether other WhatsApp-based malware vectors were developed.

Additionally, the spyware vendor admitted in court to exploiting WhatsApp’s service to install Pegasus spyware on "between hundreds and tens of thousands" of devices, stating that it had reverse-engineered WhatsApp to achieve this capability. NSO also facilitated the spyware installation process by supplying the necessary technology and WhatsApp accounts to their clients.

The process was allegedly straightforward for clients, requiring them only to enter a target mobile phone number and select "Install" on a program running on their laptop, which would deploy Pegasus onto the targeted devices remotely — all managed by NSO’s system, with no need for technical expertise from the clients.

Despite this, NSO maintains that it is not accountable for its clients' actions and claims no access to any data retrieved via Pegasus, emphasizing its limited role in surveillance operations.

NSO’s Pegasus spyware has been used against various targets, including Catalan politicians, journalists, and activists, UK government officials, Finnish diplomats, and US Department of State employees.

In November 2021, the US sanctioned NSO Group and Candiru for providing software used to spy on government officials, journalists, and activists. Also, in early November 2021, Apple filed a lawsuit against NSO for invading their customers' iOS devices using Pegasus spyware.

BleepingComputer reached out to NSO Group for comment, but a spokesperson was not immediately available.