Pegasus spyware reportedly targeted MEP investigating spyware abuses during parliamentary inquiry.
Citizen Lab links Pegasus attacks to repeated compromises of Stelios Kouloglou's device.
Researchers could not identify Pegasus operator behind surveillance campaign across Europe.
A member of the European Parliament tasked with investigating the misuse of spyware across Europe was himself repeatedly targeted with NSO Group's Pegasus hacking software while that work was under way, according to a new report by researchers at the Citizen Lab at the University of Toronto.
The target was Stelios Kouloglou, a Greek journalist and former MEP who sat on the Pega committee, a special parliamentary body established in March 2022 following the Pegasus Project, a major investigation published by The Guardian and a consortium of media outlets that revealed how governments had used the Israeli-made surveillance tool against journalists, activists and politicians. Citizen Lab said his mobile device was first compromised on 21 October 2022, a period described as particularly intense in the committee's deliberations, including the drafting of its first report. His device was hacked again on 6 and 7 March 2023, when the committee was in the final stages of drafting its conclusions, coinciding with Kouloglou travelling from Athens to Brussels.
The timing of the first attack was also notable for another reason: it occurred while Kouloglou was hospitalised for elective surgery and was visited by Thanasis Koukakis, a Greek investigative journalist who had himself been a victim of what became known as the Greek Watergate, an illegal surveillance scandal involving more than eighty politicians, journalists and military officials. Koukakis had previously testified before the Pega committee.
Citizen Lab said it could not attribute the attacks to any specific government operator, though researchers noted the campaign bore the hallmarks of a separate operation targeting seven Russian and Belarusian speaking independent journalists and opposition activists based in Europe. A unique Apple ID email identified across both sets of attacks suggested a common government client, one that researchers believe likely held licences to operate in both Belgium and Greece. NSO Group did not respond to a request for comment.
Citizen Lab senior researcher John Scott-Railton described the case as the ultimate irony of Europe's spyware crisis, noting that the committee's recommendations had largely been disregarded since its report was published. He warned that more parliamentarians were likely already compromised without their knowledge.
Kouloglou, who left parliament in 2024, said the experience had made him angry, calling it a matter of corruption, justice and democracy.
