Israeli spyware was used to hack the phone of a former Greek member of the European Parliament while he was serving on a committee investigating spyware abuses in Europe, according to a report by Citizen Lab published on Friday, Anadolu reports.
The University of Toronto-based research group said that forensic analysis found Stelios Kouloglou’s iPhone was successfully infected with Pegasus spyware, developed by Israeli company NSO Group, in October 2022 and again the next March.
Kouloglou, a journalist and former MEP, was at the time a substitute member of the European Parliament’s PEGA committee, which was established to investigate the use of Pegasus and equivalent surveillance spyware in EU member states.
Citizen Lab said the infections took place during key periods of PEGA committee activity and could have exposed non-public information, confidential documents, and internal committee deliberations.
“The spyware would have likely captured non-public information about committee activities, possibly breaching EU parliamentary confidentiality and privilege frameworks,” the report said.
The first infection occurred as the committee was preparing hearings on spyware, working on its draft report, and planning fact-finding visits to Greece and the Greek Cypriot Administration. Citizen Lab said Kouloglou’s phone was hacked 10 days before those visits began.
The second infection took place while the committee was engaged in intense discussions over the final drafting process of its report. Kouloglou was in Brussels on March 6-7, 2023, during the period of the infection.
– ‘Inconceivable’
Kouloglou said he was shocked by the findings, describing it as “inconceivable” that a member of the parliamentary committee investigating spyware abuses had himself become a surveillance target, according to Greek news outlet Dnews.
He said he plans to pursue legal action against NSO Group and those responsible for infecting his device, while also raising the issue again through contacts in the European Parliament.
Citizen Lab said the attacks used a “zero-click” exploit, meaning the phone could be compromised without the user opening a link or taking any action.
The group said it was not attributing the attacks to any specific government and found no indication that the Greek government was responsible.
However, it said the first infection overlapped with a previously identified Pegasus campaign targeting Russian and Belarusian-speaking exiled journalists and activists in Europe, suggesting that a Pegasus customer authorized to operate in multiple European countries may have been behind the attack.
Citizen Lab warned that the case posed a serious threat to democratic institutions, saying the hacking could have exposed confidential exchanges among lawmakers and staff, including to parties under investigation by the committee itself.
