Pegasus spyware hacked Greek MEP on EU inquiry committee

Pegasus spyware repeatedly infected the phone of former Greek MEP Stelios Kouloglou while he served on the European Parliament’s PEGA Committee, the body created to examine spyware abuse across the bloc.

Kouloglou, a Greek investigative journalist elected to the European Parliament in 2015 and again in 2019 on Syriza’s list, served as a substitute member of the PEGA Committee from March 24, 2022, to July 18, 2023. Citizen Lab found his first infection occurred on October 21, 2022, while he was in hospital recovering from elective surgery.

Researchers did not assign the infections to a specific government and found no indication that the Greek government was responsible. Kouloglou is the first publicly identified PEGA Committee member found to have been infected with Pegasus.

The committee emerged from the wider Pegasus Project disclosures, which exposed the use of spyware against journalists, politicians, lawyers, diplomats and civil society figures across Europe. Amnesty International says the project involved more than 80 journalists from 17 media organizations in 10 countries and revealed 50,000 phone numbers of potential surveillance targets. The European Parliament voted on March 11, 2022, to create the inquiry committee. The panel spent 2022 and 2023 examining spyware use in the EU and issued its final recommendations in June 2023.

In November 2021, the U.S. Department of Commerce placed NSO Group on a blocklist over malicious cyber activity, and the Council of Europe condemned state use of spyware for political purposes. In February 2024, spyware was found on the phones of two MEPs and a staff member on the Parliament’s security and defense subcommittee, including chair Nathalie Loiseau and Elena Yoncheva.

Citizen Lab found Kouloglou’s case overlapped with a visit from Greek investigative journalist Thanasis Koukakis, who had himself previously been hacked with Predator spyware.