A former member of the European Parliament who helped investigate spyware abuse was hacked with Pegasus while serving on the legislature’s inquiry into surveillance tools, intensifying concerns that commercial cyberweapons have been aimed at democratic oversight itself.Forensic researchers identified Stelios Kouloglou, a Greek journalist and former MEP, as the target of multiple Pegasus intrusions on his iPhone between October 2022 and March 2023. At the time, he was a member of the European Parliament’s PEGA committee, set up to examine the use of Pegasus and equivalent surveillance spyware across the European Union.
The findings indicate that the attacker may have gained access to material linked to one of the bloc’s most sensitive parliamentary investigations. Such access could have included messages, files, contacts, deliberations and other communications connected to the committee’s work. Pegasus is designed to penetrate smartphones silently and can extract data, monitor communications and potentially activate microphones or cameras without the user’s knowledge.
Kouloglou served as an MEP from 2015 to 2024 and sat on the PEGA committee during a period when the panel was examining spyware scandals in several member states. The committee’s work covered allegations of unlawful surveillance involving politicians, journalists, lawyers, activists and civil society figures. It focused heavily on Pegasus, made by Israel’s NSO Group, and other high-end commercial spyware products marketed to governments for law-enforcement and national-security purposes.
The case stands out because the target was not only a public official but also a participant in an inquiry into the same class of surveillance technology used against him. It marks one of the clearest known examples of spyware being deployed against a lawmaker during active parliamentary scrutiny of spyware abuses in Europe.
The suspected infections took place while the committee was gathering evidence and preparing its conclusions. The PEGA committee began work in 2022 after a series of disclosures showed that spyware had been used or allegedly used in EU member states including Greece, Hungary, Poland and Spain. Its final work warned that weak controls, national-security secrecy and limited accountability had allowed intrusive surveillance tools to spread with insufficient oversight.
No government has been publicly identified as responsible for the hacking of Kouloglou’s phone. The forensic trail, however, has drawn attention to the opaque nature of the spyware market, where governments can buy advanced intrusion capabilities from private firms and deploy them through layers of technical infrastructure that make attribution difficult.
Greece had already faced political pressure over spyware claims after the separate Predator surveillance scandal, which involved allegations that politicians, journalists and business figures were targeted. The government in Athens has denied unlawful conduct and has argued that surveillance powers are subject to legal safeguards. The Kouloglou case adds another politically charged element because it concerns a Greek former lawmaker involved in an EU-level probe into spyware abuse.
NSO Group has long maintained that Pegasus is sold only to vetted government customers for use against terrorism and serious crime. The company has said it does not operate the systems used by clients and has pledged to investigate credible allegations of misuse. Critics argue that repeated cases involving journalists, opposition figures, lawyers and rights defenders show that existing controls have failed.
The wider spyware industry has come under growing legal and regulatory pressure. NSO Group has faced lawsuits from major technology companies and has been placed on a United States trade restriction list. Courts and regulators have examined claims that Pegasus was used to exploit messaging systems and breach devices belonging to civil society figures. The company has denied wrongdoing in several proceedings and continues to defend the legality of its business model.
The European Parliament’s spyware inquiry called for stronger EU-level controls, including tighter export rules, clearer safeguards for national-security surveillance, remedies for victims and greater transparency around government procurement. Rights groups and several lawmakers have argued that the bloc has moved too slowly, leaving enforcement largely in the hands of national authorities that may themselves be implicated in spyware use.
The hacking of a PEGA committee member is likely to sharpen calls for a dedicated European capacity to detect and investigate spyware attacks. Lawmakers have previously pushed for a technical laboratory or rapid-response mechanism that could help public officials, journalists and activists verify suspected intrusions without relying solely on private researchers or technology companies.
The case also raises immediate questions for parliamentary security. Elected officials routinely handle sensitive briefings, draft reports, confidential correspondence and communications with whistleblowers. A compromised phone can expose not only the target but also colleagues, witnesses and sources who believed they were communicating with a protected institution.
Topics
Technology