The move is a significant sanction against a company spotlighted in July by the global Pegasus Project consortium, including The Washington Post and 16 other news organisations worldwide. The consortium published dozens of articles detailing misuse of the Pegasus spyware by customers of NSO.

The Commerce Department said in a statement that the action is part of the Biden administration's "efforts to put human rights at the centre of US foreign policy, including by working to stem the proliferation of digital tools used for repression.

The US has also added Israel's Candiru, Russian security firm Positive Technologies, and Singapore-based Computer Security Initiative Consultancy to the entity list.