Stelios Kouloglou, an ex-Member of the European Parliament (MEP) who was part of the committee investigating Pegasus spyware abuses, had his phone repeatedly compromised by the same spyware. This was revealed by recent forensic analysis from the Citizen Lab.
Spyware Breach Amid Ongoing Inquiry
This incident marks the first instance of a PEGA Committee member being publicly identified as a Pegasus victim while actively participating in the investigation. Kouloglou was a substitute member of the European Parliament’s Committee of Inquiry into Pegasus and similar surveillance software from March 2022 until July 2023. A forensic examination of his iPhone in May 2026 revealed multiple compromises during critical committee activities.
His device suffered infections on October 21, 2022, and March 6-7, 2023. The initial breach utilized the PWNYOURHOME zero-click exploit, evidenced by a lookup for a HomeKit-linked email followed by Pegasus network activity shortly thereafter.
Chronology of Infections
Apple notified Kouloglou about potential threats on three occasions: March 2, 2023, August 29, 2023, and April 10, 2024. However, he does not recall seeing these alerts. The infection dates coincided with significant periods of PEGA Committee activity, such as report drafting and international visits.
The October 2022 infection occurred just before a PEGA delegation trip to Cyprus and Greece, which Kouloglou planned and attended. This infection also coincided with the committee’s first report drafting, involving significant communication among members.
Potential Implications and Reactions
During the October 2022 infection, Kouloglou was hospitalized for elective surgery and was visited by Greek journalist Thanasis Koukakis, known for his testimony on similar spyware issues. The timing raised concerns about potential breaches of medical privacy under Greek data protection laws.
The subsequent infection in March 2023 occurred while Kouloglou was in Brussels, during final negotiations on the committee’s report, aligning with a PEGA delegation visit by rapporteur Sophie in ‘t Veld.
Citizen Lab refrained from attributing the hacking to any government, stating no evidence pointed to Greek involvement or their status as an NSO Group customer. However, researchers noted an overlap with a 2024 report on Pegasus targeting of journalists and activists in Europe.
Broader Context and Future Outlook
Kouloglou joins a list of MEPs targeted by spyware, including Catalan MEPs and Greek MEP Nikos Androulakis. More recently, MEPs Nathalie Loiseau and Daniel Freund have confirmed similar targeting.
This case underscores the persistent threat of spyware to political figures and raises questions about cybersecurity measures within the European Parliament. The situation calls for enhanced security protocols to safeguard against future breaches.
