Former EU Lawmaker Investigating Pegasus Was Secretly Hacked With the Same Spyware

A former member of the European Parliament investigating spyware abuse across Europe became a victim of Pegasus spyware himself.

Citizen Lab has revealed that former Greek MEP Stelios Kouloglou was repeatedly targeted while serving on the European Parliament’s PEGA Committee. The committee was created to investigate the growing use of commercial spyware across the European Union.

The case is the first publicly known example of a PEGA committee member being infected with Pegasus spyware during the investigation.

Citizen Lab Found Multiple Pegasus Spyware Infections

Citizen Lab’s forensic investigation found that Kouloglou’s iPhone was infected with Pegasus spyware at least three times between October 2022 and March 2023.

The attacks took place while the committee was examining allegations that governments had used Pegasus and other surveillance tools against journalists, politicians, activists, and civil society organizations.

Researchers believe the attackers exploited a previously unknown vulnerability in Apple’s software. Apple has since patched the flaw. The company also sent Kouloglou several threat notifications. Those alerts warned that his iPhone may have been targeted by state-sponsored attackers.

Attacks Happened During the PEGA Investigation

The first confirmed infection occurred in October 2022. At the time, PEGA members were gathering evidence and preparing reports on the use of commercial spyware across the European Union.

Kouloglou said he never expected a member of the committee investigating Pegasus to become one of its victims.

The former journalist served in the European Parliament from 2015 until 2024.

Citizen Lab Could Not Identify the Operator

Citizen Lab could not determine who deployed Pegasus spyware against Kouloglou.

However, investigators discovered similarities between the infrastructure used in this case and earlier Pegasus campaigns. Those operations targeted Russian- and Belarusian-speaking journalists and opposition figures living in Europe.

The evidence suggests the same spyware operator may have been involved. Even so, Citizen Lab said it could not make a definitive attribution.

European Parliament Continues to Strengthen Security

The European Parliament declined to comment directly on Kouloglou’s case. However, officials said the institution continues to monitor cybersecurity threats targeting parliamentary systems.

Officials also noted that lawmakers have had access to spyware detection tools since 2022. In addition, a recently adopted parliamentary report recommends extending those protections to every device used for parliamentary work.

Pegasus Spyware Remains Under Global Scrutiny

Pegasus spyware was developed by Israel-based NSO Group. According to the company, the software is sold only to government agencies investigating terrorism and serious crime.

However, Pegasus spyware has repeatedly been linked to surveillance campaigns targeting journalists, lawyers, politicians, activists, and other members of civil society. As a result, the software has faced lawsuits, sanctions, and growing international criticism over its alleged misuse.

The latest case adds another high-profile victim to the list of people targeted with Pegasus spyware. More importantly, it shows that even lawmakers investigating surveillance abuses can become targets themselves.