- Published on
Politician who investigated spyware abuses had his phone hacked with Pegasus spyware
- Authors
- Name
- DeepHorus
Security researchers have confirmed that a European politician had his phone hacked with the Pegasus spyware while serving on an investigatory committee probing abuses of the notorious surveillance tool. The Citizen Lab at the University of Toronto identified Greek journalist and former politician Stelios Kouloglou as the victim, marking the first time a member of the European Parliament’s PEGA committee has been publicly identified as a spyware target. The hacking, which occurred during 2022 and 2023, has reignited controversy over governments using spyware to collect information on critics.
Kouloglou was a member of the PEGA committee, which was established to investigate phone spyware attacks by European governments. According to a Citizen Lab report released Friday, his phone was compromised in October 2022 and at least twice in March 2023. The exploits took advantage of a security vulnerability in Apple’s iPhone software that had been patched but not yet installed on Kouloglou’s device. The spyware used a zero-click exploit, meaning it infiltrated his phone without any interaction from him, stealing text messages, location data, and photos.
The timing of the hacks aligns with critical moments in the committee’s work. The October 2022 hack coincided with intense discussions over email and text message ahead of a draft report detailing spyware abuses in Cyprus, Greece, Hungary, Poland, and Spain. The March 2023 hacks occurred while Kouloglou traveled from Athens to Brussels during committee hearings, months before the final report was adopted. This suggests an intense focus on the committee’s inner workings.
Implications of the hacking are significant. One serving European lawmaker described it as a direct attack on the rule of law and called on the European Commission to impose strict limits on spyware use across the 27-member bloc. The targeting of a committee investigator by the very spyware under investigation raises fresh questions about how governments use surveillance tools ostensibly for fighting serious crime but end up spying on journalists, lawmakers, and critics.
In a phone call with TechCrunch, Kouloglou expressed anger upon learning his phone had been hacked. He stated he did not know why he was specifically targeted but believed it was due to his work on the PEGA committee. Citizen Lab researchers did not attribute the hacking to a specific country but noted that the same Pegasus-loaded email address used in a previous campaign targeting journalists across Europe was employed. This implies the customer had authorization from NSO Group, the spyware's developer.
Neither the European Commission nor NSO Group responded to requests for comment. The Citizen Lab report underscores the ongoing abuse of spyware and the need for stricter oversight. As the PEGA committee’s findings are widely anticipated, this incident may push the European Union to take concrete action against unauthorized surveillance, potentially limiting the use of tools like Pegasus within member states.
