Pegasus Zero-Click Spyware Targets EU Parliament Investigator
Written by AI from the linked story. Not reviewed by an editor. How this works
A European Parliament member investigating commercial spyware abuse was himself targeted with Pegasus via a zero-click exploit in Apple's HomeKit, requiring no user interaction to compromise the device. This attack demonstrates the acute risk that sophisticated, state-licensed spyware poses to democratic oversight processes — the very people investigating surveillance abuse were being surveilled. The repeated infections over several months suggest a failure to detect, respond to, and remediate the initial compromise, allowing prolonged access to sensitive committee materials. When high-value public officials handle confidential legislative work on personal or insufficiently hardened devices, the consequences extend beyond individual privacy to institutional integrity and national security.
Tactical Insight
Immediate actions
- Apply all available iOS security patches immediately and enable Lockdown Mode on devices belonging to high-risk individuals such as lawmakers, journalists, and activists.
- Conduct forensic triage (e.g., using MVT/Citizen Lab tools) on devices belonging to anyone involved in sensitive investigations or oversight roles.
- Revoke and rotate credentials and access tokens for any accounts accessible from a potentially compromised device.
Long-term improvements
- Establish a dedicated device security program for high-risk personnel that includes hardened, regularly wiped devices and strict separation between personal and official use.
- Implement institutional policies requiring officials on sensitive committees to use managed, monitored devices with zero-click exploit mitigations enabled.
- Engage with national CERTs or trusted security partners to provide ongoing threat intelligence tailored to political and civil society targets.
Detection measures
- Deploy Mobile Device Management (MDM) solutions with anomaly detection to flag unusual network traffic or process behavior indicative of spyware activity.
- Perform periodic forensic scans of devices used by high-risk individuals using tools like Amnesty Tech's Mobile Verification Toolkit (MVT).
- Establish clear incident reporting channels so officials can quickly escalate suspected device compromises to security teams.