A European politician who served on a committee investigating spyware abuses had his own phone hacked with Pegasus spyware while the inquiry was underway, researchers at the University of Toronto’s Citizen Lab confirmed in a report published Friday.
The target was Stelios Kouloglou, a Greek journalist and former member of the European Parliament who sat on the EU’s PEGA committee — a body specifically tasked with probing spyware abuses by European governments. Citizen Lab said Kouloglou’s iPhone was compromised in October 2022 and at least twice in March 2023, making him the first publicly identified PEGA committee member to be confirmed as a spyware victim.
The attacks used a “zero-click” exploit targeting a vulnerability in Apple’s iPhone software, meaning the spyware broke in without any action required from Kouloglou. The flaw had been patched but the fix had not yet been installed on his device. Once inside, the spyware accessed text messages, other correspondence, location data, and photos.
The October 2022 hack coincided with intense committee discussions ahead of a draft report on spyware abuses in Cyprus, Greece, Hungary, Poland, and Spain — and occurred while Kouloglou was hospitalized for a pre-scheduled surgery. The March 2023 intrusions took place as he traveled from Athens to Brussels during committee hearings, months before the committee finalized its written report.
Citizen Lab did not attribute the hacking to a specific country, but said the government customer used the same Pegasus-linked email address tied to a prior campaign that targeted journalists across Europe, suggesting NSO Group had authorized the customer to operate across multiple European countries.
NSO Group and the European Commission did not respond to requests for comment. Kouloglou told TechCrunch he plans to sue NSO Group and said he was going public “for democracy, human rights, and the fight against corruption.” One serving European lawmaker called the hacking “a direct attack on the rule of law” and urged the European Commission to impose strict limits on spyware use across the EU’s 27 member states.
Source: TechCrunch