A new report from the Citizen Lab has revealed that former Member of the European Parliament Stelios Kouloglou had his mobile device repeatedly hacked with the notorious Pegasus spyware — while serving on a committee tasked with investigating the abuse of commercial surveillance tools in the European Union.
“Through forensic analysis of his device, we found that the attackers could have had access to confidential documents and committee deliberations,” the Citizen Lab researchers said in their report.
Timeline of Infection
Forensic analysis of artifacts collected from Kouloglou’s iPhone in May 2026 found it was compromised with NSO Group’s Pegasus spyware on or around October 21, 2022, and again on March 6 and 7, 2023. The attack weaponized a zero-click exploit in Apple’s HomeKit software, codenamed PWNYOURHOME, which was subsequently addressed by Apple in iOS 16.3.1.
The timing is deeply significant:
- The first infection occurred while Kouloglou was hospitalized for elective surgery — visited by a Greek investigative journalist whose own phone was compromised with Predator spyware
- The second infection coincided with intense discussions related to the final drafting of the PEGA Committee’s report
- Kouloglou received Apple threat notifications about mercenary spyware targeting on three occasions but was never told his device had actually been breached
Who Was Behind It?
The infections have not been attributed to a particular government. However, Citizen Lab identified an overlap between the first infection and a previous campaign targeting Russian and Belarusian-speaking exiled journalists and activists in Europe — indicating a Pegasus customer with authorization to operate in multiple EU jurisdictions is likely responsible.
This marks the first time a member of the PEGA Committee has been publicly identified as a Pegasus victim while actively serving on the committee investigating spyware abuse — underscoring the profound risks faced by those who probe the surveillance industry.
