The lawyer had represented several plaintiffs in lawsuits that accused NSO Group of providing tools to hack the phones of a Saudi Arabian dissident living in Canada, a Qatari citizen and a group of Mexican journalists and activists. He contacted Citizen Lab.

The researchers said they discovered that NSO technology left digital crumbs that helped them uncover the spy campaign. The weakness: Whoever was using the NSO Group hacking tools had to place a WhatsApp call to their target. Even if the target did not pick up the phone, NSO’s technology would become embedded in the phone and provide access to all of its contents.

The missed calls, however, tipped off the lawyer, he told The New York Times.

After WhatsApp patched the security hole, NSO employees lamented that the company closed off a major espionage channel. An NSO employee even told a WhatsApp employee in a message: “You just closed our biggest remote for cellular,” according to the WhatsApp complaint.

Citizen Lab and WhatsApp would not name the individuals targeted, citing privacy policies.

WhatsApp said in a statement that it was informing affected customers with special WhatsApp messages. The company is seeking a permanent injunction to block NSO from its service, and called on lawmakers to ban the use of cyberweapons like those sold by NSO Group to governments.

“This should serve as a wake-up call for technology companies, governments and all internet users,” Will Cathcart, the head of WhatsApp, wrote in an opinion article in The Washington Post on Tuesday. “Tools that enable surveillance into our private lives are being abused and the proliferation of this technology into the hands of irresponsible companies and governments puts us all at risk.”

Mr. Cathcart also urged technology firms to join a call from the United Nations special rapporteur, David Kaye, for an immediate moratorium on the sale, transfer and use of dangerous spyware.

NSO Group is one of dozens of digital spy outfits that provide technology to track everything a target does on a smartphone. Its spyware allows governments to track the location, communications, contacts and web activities of targets. But such access can be easily abused.