Pegasus Spyware Hacked MEP Investigating Spyware Abuses
Original: Politician who investigated spyware abuses had his phone hacked with Pegasus spyware
Why This Matters
The case highlights the persistent misuse of commercial spyware against democratic institutions and oversight bodies.
The Citizen Lab confirmed that Greek journalist and former MEP Stelios Kouloglou had his phone hacked with Pegasus spyware in October 2022 and at least twice in March 2023 — while serving on the European Parliament's PEGA committee investigating government spyware abuses.
Researchers at the University of Toronto's Citizen Lab confirmed that Stelios Kouloglou, a Greek journalist and former member of the European Parliament, was hacked with NSO Group's Pegasus spyware during 2022 and 2023. Kouloglou was at the time serving on the EU Parliament's PEGA committee, which was established to investigate abuses of phone spyware by European governments. This marks the first publicly identified case of a PEGA committee member being targeted by the very surveillance tool under investigation.
According to Citizen Lab's report, the hacks occurred in October 2022 and at least twice in March 2023, exploiting a patched but uninstalled vulnerability in Apple's iPhone software via a 'zero-click' exploit — requiring no user interaction. The flaw abused Apple's smart home software to silently extract text messages, correspondence, location data, and photos.
Citizen Lab did not attribute the attack to a specific country, but noted the attacker reused the same Pegasus-loaded email address linked to a prior campaign targeting journalists across Europe, suggesting NSO Group authorized the customer's multi-country operations. Kouloglou called the compromise 'reckless.' One sitting EU lawmaker described it as 'a direct attack on the rule of law' and urged the European Commission to impose strict spyware limits across all 27 member states. Neither NSO Group nor the European Commission responded to requests for comment.