EU lawmaker investigating Pegasus spyware targeted by the tool itself

Digital rights researchers at The Citizen Lab confirmed that Kouloglou’s device was breached via a zero-click exploit in October 2022 and twice in March 2023. The spyware, which targeted a vulnerability in Apple’s smart home software, harvested private correspondence, location data, and photos. The timing of these intrusions aligns with critical periods in the committee’s work, including the drafting of reports concerning surveillance practices in Greece, Poland, Hungary, Spain, and Cyprus.

While researchers could not identify the specific government behind the attack, the forensic evidence points to an operator using an email address previously linked to spyware campaigns against European journalists. This suggests a state actor with NSO Group’s authorization systematically monitoring the committee’s internal activities. Kouloglou, who intends to sue the Israeli-based NSO Group, described the intrusion as a reckless violation of his privacy and a direct assault on democratic oversight. The incident has intensified calls for the European Commission to implement rigorous, continent-wide restrictions on spyware usage.