Citizen Lab Says NSO Group Pegasus Repeatedly Infected Stelios Kouloglou on PEGA Committee

Citizen Lab reported that former Member of the European Parliament Stelios Kouloglou was repeatedly infected with NSO Group’s Pegasus spyware while serving on the PEGA committee, which ran from March 2022 to July 2023.

“A former member of the European Parliament was hacked with Pegasus spyware while serving on a committee investigating surveillance by the tool’s Israeli creator, a Canadian research group has found”

Al Jazeera

The Citizen Lab report said the first infection happened on October 21, 2022, and again on March 6 and 7, 2023, during periods of intense PEGA activity including drafting of the committee’s first report and final drafting of its report.

Al Jazeera

Citizen Lab said the first infection involved a zero-click exploit targeting Apple’s HomeKit system, assessing that “the phone was hacked with thePWNYOURHOMEzero-click exploit at this point.”

The Citizen Lab report also said Kouloglou’s device was running iOS 15.5 on both infection dates, and that the attackers could have had access to “confidential documents and committee deliberations.”

The Times of Israel said EU lawmakers voiced outrage in Brussels after the Citizen Lab report found Kouloglou’s phone was infected with Pegasus in 2022 and 2023 while he sat as a substitute on the European Parliament committee investigating the spyware’s use.

Belgian Green lawmaker Saskia Bricmont said she was “shocked,” urging the European Commission to “take binding measures to ban the illegal use of spyware in Europe,” while the Left group called for “strong measures” against spyware and Renew said it was “very concerned.”

Anadolu Ajansı

The Guardian reported that Citizen Lab “could not attribute the attacks against Stelios Kouloglou to any particular government operator of Pegasus spyware,” but said the attack bore hallmarks of a previous hacking campaign against exiled Russian and Belarusian journalists and opposition activists.

In an interview, Kouloglou told The Guardian, “When you realise your private life is scrutinised by very bad people, you become angry,” framing the issue as “a big issue having to do with corruption, justice and democracy.”

Citizen Lab said the infections could have exposed “strictly confidential exchanges among PEGA Committee members and their staff,” and other sensitive parliamentary proceedings, including to parties under investigation by the committee itself.

“World Greek politician Stelios Kouloglou's phone was hacked with Pegasus spyware while investigating its misuse, raising concerns over spyware abuse in Europe”

Daily Beirut

The Citizen Lab report said it found no evidence linking the operation to the Greek government, while noting that infections appeared in at least two European jurisdictions, “Greece and Belgium,” and assessing that the customer likely had a license enabling infections across multiple EU jurisdictions.

Al Jazeera quoted Citizen Lab describing the case as highlighting “the serious threat that mercenary spyware poses to the integrity of democratic processes,” and said Kouloglou received Apple threat notifications after the intrusions.

Al Jazeera also reported that Rand Hammoud said the case should concern “everyone who cares about democracy, fundamental rights, and the rule of law in Europe,” and that Hannah Neumann said “Spyware doesn’t make democracies safer,” adding that it “weakens democratic oversight, parliamentary independence and the rule of law.”