Citizen Lab Finds Pegasus Spyware Hacked Phone of MEP Who Investigated Pegasus Abuses, as Civil Society Demands EU Action

Overview

A forensic investigation by The Citizen Lab has found that the iPhone of Stelios Kouloglou, a former Member of the European Parliament, was infected with Pegasus spyware while he was serving on the very European Parliament committee set up to investigate Pegasus abuses. The finding, published July 3, 2026, has drawn a joint demand from more than 40 civil society organizations and independent experts for the European Union to open an independent investigation and act on recommendations its own inquiry issued three years ago.

What We Know

Kouloglou was a substitute member of the European Parliament’s Committee of Inquiry to investigate the use of Pegasus and equivalent surveillance spyware, known as the PEGA Committee, from March 24, 2022 to July 18, 2023. According to Citizen Lab, his phone was infected with Pegasus spyware, made by Israeli firm NSO Group, on or around October 21, 2022, and again on March 6 and 7, 2023 — dates that fall squarely within his committee tenure.

The October 2022 intrusion relied on the “PWNYOURHOME” exploit, which Citizen Lab describes as first involving “a specially crafted NSKeyedArchive that landed in HomeKit, followed by malicious content that landed in MessagesBlastDoorService.” According to TechCrunch, the exploit was a “zero-click” bug, meaning it stole data without requiring any interaction from Kouloglou, and it relied on a vulnerability for which a fix existed but had not yet been installed on his phone.

Citizen Lab said that “through forensic analysis of his device, we found that the attackers could have had access to confidential documents and committee deliberations.” The timing of the October 2022 hack coincided with intense internal discussion ahead of a first draft of committee findings that, according to TechCrunch, described spyware abuses focused in Cyprus, Greece, Hungary, Poland, and Spain.

Citizen Lab said it found no evidence implicating the Greek government in the hacking, according to Al Jazeera, and did not attribute the intrusions to any specific government. Al Jazeera also reported that Kouloglou requested the forensic investigation from Citizen Lab in May.

Kouloglou, also a Greek investigative journalist, described the scope of what was exposed. “You realize that all of your personal data [was taken] — not all the professional exchanges or messages with ministers — but also the very private things, like the happy moments and the sad moments,” he told TechCrunch. Speaking to The Record, he said: “In my phone, there were 15 years of photos, messages, you name it, messages with the prime ministers, with the members, the leaders of the different political parties and journalists. … Everything.” Both TechCrunch and The Record report that Kouloglou plans to sue NSO Group.

John Scott-Railton, the Citizen Lab researcher who worked on the investigation, told The Record that more cases are likely to surface: “I know what the next chapter of this story is — it’s going to be more hacked members of parliament, and I would bet that there are members of the European Parliament today walking around with no idea that their phone in their pocket has been turned into a spy.” German Green Party MEP Hannah Neumann, also speaking to The Record, said the episode “shows a total disregard for Parliamentarians’ role to scrutinize and, as such, for European democracy,” adding: “It’s totally absurd that nothing’s being done, but still there is this fake notion of spyware contributing to security, when in fact it undermines security.”

The PEGA Committee released its recommendations in May 2023. The Record reports the European Commission has largely ignored them since. The Register reports that the EU’s Directorate-General for Information Technologies and Cybersecurity, known as DG ITEC, has not opened an investigation into the Kouloglou hacking.

Elina Castillo Jiménez, Advocacy and Policy Advisor for the Security Lab at Amnesty International, said: “The fact that Stelios Kouloglou’s device was infected with an intrusive form of spyware that only governments can procure, while he was actively involved in the parliamentary inquiry committee that was investigating spyware abuse by European countries, raises serious concerns about the integrity of independent oversight at the highest levels in Europe.” She added: “If an elected member of parliament is not safe from unlawful surveillance, then no one is.”

More than 40 civil society organizations and independent experts, including Access Now, Amnesty International, the Committee to Protect Journalists, Privacy International and European Digital Rights, signed a joint statement calling the revelation “a rule of law emergency, threatening the very foundations of our society.” The statement calls on DG ITEC to open a full, independent investigation; on the European Commission to publicly respond to the PEGA Committee’s recommendations and set a roadmap for addressing what it calls the EU’s spyware crisis; on member states to guarantee remedies for surveillance victims; on the Commission to strengthen enforcement of the EU’s Dual-Use Regulation; and to ensure EU funds do not support spyware companies.

What We Don’t Know

Citizen Lab has not identified which government or Pegasus customer was responsible for the intrusions, and the European Commission has not yet issued a formal response to the July joint statement’s demands. It also remains unclear whether DG ITEC will open the independent investigation the signatories are requesting, or whether the European Commission will act on the PEGA Committee’s May 2023 recommendations, which have gone substantially unimplemented for more than three years.