European Parliament Member Investigating Spyware Was Hacked With Pegasus
EU Parliament member investigating spyware was repeatedly hacked with Pegasus while serving on oversight committee.
Citizen Lab researchers discovered that former European Parliament member Stelios Kouloglou was infected with Pegasus spyware on multiple occasions (October 2022, March 2023) while serving on the PEGA Committee investigating commercial surveillance abuse in the EU. The infections were likely delivered via a zero-click exploit in Apple's HomeKit software (PWNYOURHOME), and forensic analysis indicates attackers could have accessed confidential committee documents and deliberations. The attack infrastructure overlaps with campaigns targeting Russian and Belarusian-speaking journalists and activists in Europe, suggesting a licensed Pegasus operator with multi-country authorization.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Apple?
Get an email when a new story names Apple, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonA European Parliament member investigating commercial spyware abuse was himself targeted with Pegasus via a zero-click exploit in Apple's HomeKit, requiring no user interaction to compromise the device. This attack demonstrates the acute risk that sophisticated, state-licensed spyware poses to democratic oversight processes — the very people investigating surveillance abuse were being surveilled. The repeated infections over several months suggest a failure to detect, respond to, and remediate the initial compromise, allowing prolonged access to sensitive committee materials. When high-value public officials handle confidential legislative work on personal or insufficiently hardened devices, the consequences extend beyond individual privacy to institutional integrity and national security.
What helps against this
How we list vendors
- Phishing-resistant MFA
A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.
- Automated patch management
Known holes get closed in days, not months.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- email — rauharepo888@gmail.com
- malware — Pegasus
- malware — Predator