European Parliament Spyware Investigator Himself Hacked with Pegasus: Citizen Lab Findings and EU Response

On July 3, 2026, the University of Toronto's Citizen Lab published a forensic report revealing that Stelios Kouloglou — a Greek investigative journalist and former Member of the European Parliament (2019–2024) — was repeatedly infected with NSO Group's Pegasus spyware while serving as a substitute member of the European Parliament's PEGA Committee (the committee created to investigate the use of Pegasus and equivalent surveillance spyware) .

Key Facts from the Citizen Lab Investigation

• Two confirmed infections occurred in October 2022 and March 2023, both coinciding with critical periods of PEGA committee activity. A possible third infection was also detected .
• The infections used a zero-click exploit chain (codenamed PWNYOURHOME) that required no user interaction .
• Kouloglou's iPhone was compromised while he was in Athens and Brussels, and the spyware would have likely captured non-public committee information, communications, and parliamentary privilege material .
• Citizen Lab could not definitively attribute the attacks to a specific government actor, but noted that Pegasus is licensed exclusively to government clients .
• This marks the first time a member of the PEGA Committee has been publicly identified as a Pegasus target .

Civil Society Response

Within days of the Citizen Lab report, a coalition of civil society organizations — coordinated by CDT Europe — issued a joint statement (published July 6, 2026) calling for urgent EU action . Key demands include:

• DG ITEC (the European Parliament's IT department) must conduct a full, independent, and impartial investigation into the hacking of Kouloglou's device .
• The EU must finally deliver a meaningful, EU-wide regulatory response to the proliferation and abuse of commercial spyware, which they note has been lacking for nearly three years since the PEGA Committee's recommendations .
• Independent oversight mechanisms must be strengthened, and fundamental rights protections must be enforced .

Separately, in February 2026, the European Data Protection Board (EDPB) formally replied to a civil society open letter on spyware abuse cases in the EU, indicating engagement at the institutional level .

EU Institutional Response

• PEGA Committee Investigation (2022–2023): The committee held extensive hearings, visited multiple member states, and in June 2023 adopted a final recommendation identifying country-specific shortcomings and proposing EU-wide spyware surveillance standards . The European Parliament plenary adopted the recommendation in June 2023 .
• European Public Prosecutor's Office (EPPO): In 2024, EPPO launched an investigation into the Greek "Predatorgate" scandal, following a request from Kouloglou himself .
• June 2025 Parliamentary Debate: In a formal debate on the "State of play and follow-up two years after the PEGA recommendations," multiple MEPs stated that the European Commission had 'utterly failed' to take decisive action on spyware regulation .
• Broader EU Policy: The EU has inched toward tighter export controls and procurement limits on spyware, though comprehensive legislation has not yet been enacted . The European Commission announced an 'Anti-Spyware Initiative' legislative package planned for Q4 2025, though as of mid-2026 it has not been enacted .

Bottom line: The Kouloglou case — combined with the parallel Greek "Predatorgate" scandal where four individuals (two Israelis and two Greeks) went to trial in September 2025 — has intensified pressure on EU institutions to move from recommendations to binding regulation, with civil society groups warning that the political will for reform has stalled despite mounting evidence of systemic abuse.