A former member of the European Parliament, Stelios Kouloglou, was infected multiple times with Pegasus spyware while serving on the PEGA committee, which was investigating the abuse of such software. This is revealed in a new report from the University of Toronto's Citizen Lab, published on Friday. Kouloglou, who was an MEP from 2015 to 2024 and a former investigative journalist, said he was shocked and then angry when he learned his device had been compromised. "Me being a member of the Pegasus Committee investigating Pegasus and at the same time being hacked by Pegasus, it was something really too reckless," he told WIRED.
A Direct Attack on the Heart of European Democracy
The Citizen Lab report marks the first time a member of the PEGA committee has been identified as a victim of spyware while working within the group. Researchers have no conclusive evidence of which government or entity was behind the attacks, but they note that whoever perpetrated them would have potentially gained access to internal information about the committee's activities and findings, violating EU parliamentary confidentiality and people's privacy. "It's open spyware season on Europe's lawmakers," said John Scott-Railton, a senior researcher at Citizen Lab. "The European Parliament, national parliaments, nobody is prepared." MEP Saskia Bricmont, a member of the PEGA committee, called the incident "a direct attack on the rule of law."
Sponsored Protocol
Multiple Infections of Kouloglou's Phone
According to Citizen Lab, Kouloglou's phone was first infected on October 21, 2022, while he was in the hospital for elective surgery. He was visited by Greek investigative journalist Thanasis Koukakis, who had previously been hacked with Predator spyware. The following week, the PEGA committee held several hearings on the impact of spyware. A second infection occurred on March 6 and 7, 2023, as the committee was finalizing its findings. MEP Hannah Neumann, also part of the investigation, noted that the dates coincide with crucial moments: "Looking at the dates, it's pretty obvious that somebody was not just randomly spying on him, but really targeted the committee's work."
Sponsored Protocol
Europe's Failure to Protect Institutions
Despite receiving three notifications from Apple (March and August 2023, April 2024), Kouloglou does not recall seeing them. The report finds overlaps between the attacks on his phone and Pegasus use against seven Russian- and Belarusian-speaking journalists and activists between August 2020 and January 2023, but no indication of Greek government involvement. "They did not only target an MEP, they spied on the investigation into spyware abuse itself. That shows the whole absurdity of the situation," Neumann said. The European Parliament stated it has a "spyware screening system" and has adopted measures to expand protections, but many committee members fear other colleagues may have been targeted and that the PEGA committee's recommendations — including an EU-based tech lab and a spyware taskforce for elections — have not been implemented. Scott-Railton concluded: "Europe has a mountain of spyware abuses, and nothing has happened — it's an embarrassment for European institutions." For further reading, check our previous article on Kouloglou's hacking and learn about California's manure-to-gas program. For more on Pegasus, visit the Wikipedia page.
Sponsored Protocol
