Stelios Kouloglou, a Greek journalist and member of the European Parliament's PEGA committee investigating spyware abuses, had his iPhone hacked with Pegasus spyware on at least two occasions in 2022 and 2023. Security researchers at the University of Toronto's Citizen Lab confirmed the hacking incidents, which exploited a vulnerability in Apple's smart home software. The spyware accessed Kouloglou's text messages, correspondence, location data, and photos during the period when he was actively investigating phone surveillance abuses across European countries.
Pegasus spyware, developed by Israeli firm NSO Group, has been the subject of increasing scrutiny globally. The PEGA committee was specifically formed to investigate the misuse of phone surveillance tools in Europe, with a focus on spyware abuses documented in Cyprus, Greece, Hungary, Poland, and Spain. The targeting of a committee member investigating these abuses underscores concerns about surveillance being weaponized against oversight efforts.
The discovery reinforces the need for stronger international oversight of spyware tools and stricter controls on their sale and deployment, as well as accountability mechanisms for manufacturers.
Researchers did not attribute the hacking to a specific country or entity, making it difficult to establish clear responsibility or determine whether this was an isolated incident or part of a broader pattern.
Imagine you're a student writing a report about cheating in your school, and someone reads all your emails and texts without your knowledge using secret hacking software. That's what happened to a European politician investigating phone spyware—he was spied on with the exact tool he was trying to stop others from using.
Without attribution to a specific country or actor, the incident illustrates the difficulty in holding actors accountable for spyware abuse, even when technical evidence of the attack is available.
scenario - not a predictionThe October 2022 hack occurred during intense committee discussions ahead of a draft describing spyware abuses, and the March 2023 incidents coincided with committee hearings, suggesting possible strategic targeting, though this remains unconfirmed.
scenario - not a predictionKouloglou's stated intention to sue NSO Group could establish a precedent for holding spyware manufacturers liable for misuse of their products, though such cases face significant legal and jurisdictional challenges.
scenario - not a prediction