Pegasus hacked MEP investigator

What's happened

Citizen Lab has found that Stelios Kouloglou's iPhone was infected with Pegasus at least three times in 2022–23 while he served on the European Parliament's PEGA committee investigating spyware. Researchers say they have high confidence in the forensic evidence but do not attribute responsibility; the findings have prompted calls in Brussels for stronger limits on spyware.

What's behind the headline?

What this reveals

• A PEGA committee member has been confirmed as a target of Pegasus. That transforms the inquiry from external criticism into a direct operational compromise of parliamentary oversight.

Who benefits and who loses

• Governments or actors using commercial spyware will gain intelligence on committee deliberations if they were responsible. Parliamentary independence and the committee's ability to investigate will suffer.

Technical and procedural implications

• The intrusions used an Apple vulnerability that had not been patched on Kouloglou's phone at the time. This shows that zero-click exploits remain the most dangerous vector and that device-level protections and rapid patching will remain essential.

Likely outcomes

• The European Parliament will face immediate pressure to expand and enforce device screening and to require hardened channels for committee work. Expect demands for binding EU rules that ban or strictly limit commercial spyware and for inquiries into which governments purchased Pegasus.

Broader consequence

• This will increase political momentum for tougher controls on the commercial spyware market and for legal action against vendors and customers. It will also push MEPs to change operational practices: more compartmentalisation of sensitive work and use of vetted devices for committee business.

Bottom line

• The discovery will force the EU to move from voluntary screening and guidance to binding technical and legal safeguards to protect parliamentary oversight and confidential deliberations.

How we got here

Journalists and rights groups exposed Pegasus abuses in 2021, prompting the European Parliament to create the PEGA committee in 2022. Citizen Lab has been analysing targeted phone intrusions and publishes forensic reports on infections tied to NSO Group's Pegasus software.

Our analysis

The reporting presents a consistent core finding but emphasises slightly different angles. The University of Toronto's Citizen Lab is the primary source across pieces: TechCrunch and The New Arab cite the lab's forensic conclusion that Kouloglou was hacked "at least three times" between October 2022 and March 2023 and that the infections exploited an Apple vulnerability. TechCrunch highlights technical detail, noting the hacks were "zero-click" and that the same attacking email address matched a prior campaign, implying reuse by the Pegasus operator. The Times of Israel and Al Jazeera concentrate on political fallout in Brussels: The Times of Israel quotes Belgian Green MEP Saskia Bricmont saying she was "shocked" and reporting calls from the Left and Renew groups for stronger measures, while Al Jazeera quotes security expert Rand Hammoud saying the case should concern "everyone who cares about democracy, fundamental rights, and the rule of law in Europe." TechCrunch and Al Jazeera both record Kouloglou's reaction; TechCrunch quotes him calling the compromise "reckless," and The New Arab records him telling Reuters he was "astonished" that a PEGA member would be spied on. Multiple outlets note that Citizen Lab did not attribute responsibility and that NSO Group has not commented; TechCrunch and Al Jazeera recall NSO's controversial history, including U.S. sanctions and litigation. Together the pieces show a technical forensic finding plus political alarm in Brussels, with consistent sourcing back to Citizen Lab and direct quotes from Kouloglou and MEPs.

Go deeper

• Which parliamentary documents or communications will be checked for compromise next?
• What technical steps will the European Parliament require for MEP devices after this report?

More on these topics

• European Parliament

  The European Parliament is one of three legislative branches of the European Union and one of its seven institutions. Together with the Council of the European Union, it adopts European legislation, normally on a proposal from the European Commission.

• NSO Group - Surveillance company

  NSO Group Technologies is an Israeli technology firm whose spyware called Pegasus enables the remote surveillance of smartphones. It was founded in 2010 by Niv Carmi, Omri Lavie, and Shalev Hulio. It employed almost 500 people as of 2017, and is based in

• Stelios Kouloglou - Member of the European Parliament

  Stelios Kouloglou is a Greek journalist writer and documentaries director. He is the creator of the news web channel "TVXS". Political analyst and major Greek publications columnist in international press including Le Monde Diplomatique.

• Brussels-Capital Region - City and region of Belgium

  Brussels, officially the Brussels-Capital Region, is a region of Belgium comprising 19 municipalities, including the City of Brussels, which is the capital of Belgium. The Brussels-Capital Region is located in the central portion of the country. It is...

• University of Toronto - Public research university in the Greater Toronto Area of Ontario, Canada

  The University of Toronto (U of T) is a public research university with three main campuses in the Greater Toronto Area of Ontario, Canada. Based on the grounds that surround Queen's Park in Toronto, it was founded by royal charter in 1827 as King's College, the first institution of higher learning in Upper Canada. Originally controlled by the Church of England, the university assumed its present name in 1850 upon becoming a secular institution. The university's three campuses are known as St. George, Mississauga, and Scarborough. Its large downtown Toronto location, St. George, is the oldest of the three and comprises 11 colleges, each with varying autonomy over financial and institutional affairs and significant differences in character and history. Its suburban campuses in the Toronto district of Scarborough to the east and city of Mississauga to the west were established in the 1960s, and together make up nearly half of the university's undergraduate student body. The University of Toronto is the largest post-secondary institution in Canada, with more than 100,000 students enrolled and over 720,000 alumni. It offers over 700 undergraduate and 200 graduate programs. The university...

• Citizen Lab - Software developer

  The Citizen Lab is an interdisciplinary laboratory based at the Munk School of Global Affairs at the University of Toronto, Canada.

• Pegasus - Software

  Pegasus is a spyware developed by the Israeli cyberarms firm NSO Group that can be covertly installed on mobile phones running most versions of iOS and Android.

• Greece - Country in the Balkans

  Greece, officially the Hellenic Republic, known also as Hellas, is a country located in Southeast Europe. Its population is approximately 10.7 million as of 2018; Athens, the nation's capital, is its largest city, followed by Thessaloniki.

• European Union

  The European Union is a political and economic union of 27 member states that are located primarily in Europe. Its members have a combined area of 4,233,255.3 km² and an estimated total population of about 447 million.

• Athens - Capital of Greece

  Athens, is the capital and largest city of Greece. Athens dominates the Attica region and is one of the world's oldest cities, with its recorded history spanning over 3,400 years and its earliest human presence started somewhere between the 11th and 7th m

• Israel - Country in the Middle East

  Israel, formally known as the State of Israel, is a country in Western Asia, located on the southeastern shore of the Mediterranean Sea and the northern shore of the Red Sea.

• Jordan Bardella - President of the National Front

  Jordan Bardella (French: [ʒɔʁdan baʁdɛla] ; born 13 September 1995) is a French politician who has been the president of the National Rally (RN) since 2022, after serving as acting president from September 2021 to November 2022 and as vice-president

• The Guardian - Newspaper

  The Guardian is a British daily newspaper. It was founded in 1821 as The Manchester Guardian, and changed its name in 1959. Along with its sister papers The Observer and The Guardian Weekly, The Guardian is part of the Guardian Media Group, owned by the S

• United States - Country in North America

  The United States of America, commonly known as the United States or America, is a country mostly located in central North America, between Canada and Mexico.

• Gaza - Wikimedia disambiguation page

  Gaza most commonly refers to: Gaza Strip, a Palestinian territory on the eastern coast of the Mediterranean Sea Gaza City, a city in the Gaza Strip Gaza may also refer to:

• Identity and Democracy - Political group in the European Parliament

  Identity and Democracy is a right-wing to far-right political group of the European Parliament, launched on 13 June 2019 for the Ninth European Parliament term.

• France - Country in Europe

  France, officially the French Republic, is a country consisting of metropolitan France in Western Europe and several overseas regions and territories.

• Apple Inc. - Technology company

  Apple Inc. is an American multinational technology company headquartered in Cupertino, California, that designs, develops, and sells consumer electronics, computer software, and online services.