# Pegasus Spyware (PWNYOURHOME Zero-Click Chain) Used Against European Parliament PEGA Committee Member Stelios Kouloglou

> Citizen Lab forensic analysis confirmed NSO Group's Pegasus spyware infected the iPhone of Stelios Kouloglou, a substitute member of the European Parliament's PEGA Committee investigating spyware abuse, on October 21, 2022 and again on March 6-7, 2023, via the zero-click PWNYOURHOME exploit chain (HomeKit -> iMessage BlastDoor -> mediaserverd). The operator has not been attributed to a specific government, but the attacker-controlled email rauharepo888@gmail.com links the case to a separate NSO customer campaign against exiled Russian and Belarusian journalists disclosed in May 2024.

- **Published:** 2026-07-03T00:00:00Z
- **Last reviewed:** 2026-07-03T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1098
- **ID:** TL-2026-1098
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 23 (full data via the Threadlinqs MCP server — Purple tier)

## Description

The Citizen Lab, in a report published July 2-3, 2026, disclosed forensic evidence that the iPhone of Stelios Kouloglou -- a Greek journalist and former Member of the European Parliament who served as a substitute member of the PEGA Committee (the European Parliament's Committee of Inquiry to investigate the use of Pegasus and equivalent surveillance spyware, active March 24, 2022 to July 18, 2023) -- was infected twice with NSO Group's Pegasus spyware. The first infection occurred on or around October 21, 2022 at approximately 10:16 UTC, ten days before Kouloglou was to join a PEGA delegation trip to Greece and Cyprus and while he was hospitalized for elective surgery. The second infection occurred between March 6 09:49 UTC and March 7 07:30 UTC 2023, coinciding with PEGA committee deliberations in Brussels on the panel's final report. Both infections were assessed by Citizen Lab with high confidence and are believed to use the same exploit chain. This is the first publicly documented case of a sitting PEGA Committee member being confirmed as a Pegasus victim during active service on the inquiry.

Both infections were delivered via PWNYOURHOME, a novel two-phase zero-click exploit chain first documented by Citizen Lab in its April 2023 'Triple Threat' report alongside two related chains (FINDMYPWN and LATENTIMAGE) used by NSO Group against iOS 15 and early iOS 16 in 2022. PWNYOURHOME's first phase abuses Apple's HomeKit smart-home framework: the attacker performs a HomeKit-linked lookup of an attacker-controlled Apple ID/email address (rauharepo888@gmail.com in this case), delivering a crafted NSKeyedArchiver-serialized message that is processed by the HomeKit daemon (homed) without adequate origin validation. This first stage crashes/manipulates the HomeKit daemon and stages a second payload delivered through iMessage, where a maliciously crafted PNG image is processed by the MessagesBlastDoorService sandbox, causing it to crash and executing attacker code. The exploit chain culminates in code execution being handed off to the mediaserverd process, from which the Pegasus implant is deployed with no visible interaction required from the victim. Apple mitigated the HomeKit phase of the attack in iOS 16.3.1 (released February 13, 2023) by adding validation that declines to decode HomeKit messages arriving from implausible sources; the MessagesBlastDoorService component was likely hardened earlier, around iOS 16.1. Both of Kouloglou's infections occurred while his device was running the outdated iOS 15.5 (build 19F77), which remained vulnerable to the full PWNYOURHOME chain. Apple's Lockdown Mode, introduced in iOS 16, is documented by Citizen Lab to block PWNYOURHOME and surface real-time attack notifications, though researchers suspect NSO Group has worked to fingerprint and evade Lockdown Mode's notification behavior.

Citizen Lab's investigation, governed by University of Toronto Research Ethics Board protocols, was unable to attribute the intrusions to a specific government or confirm which NSO Group customer conducted the operation. Investigators explicitly found no evidence implicating the Greek government or that Greece is an NSO Group customer, but noted that infection activity appears to intersect at least two European jurisdictions (Greece and Belgium), consistent with an NSO customer holding multi-jurisdiction licensing or a customer operating extraterritorially against a target traveling between EU institutions. The strongest attribution lead is infrastructural: the same rauharepo888@gmail.com HomeKit-lookup address used against Kouloglou also appears (as 'Email 1') in a May 2024 joint Citizen Lab/Access Now report, 'By Whose Authority?', which documented Pegasus infections of at least seven Russian- and Belarusian-speaking journalists and civil society figures exiled in Europe, including Latvia-based Russian journalist Maria Epifanova (infected August 2020, the earliest known Pegasus use against Russian civil society) and Poland-based Belarusian journalist Natalya Radina. Because Citizen Lab assesses that these HomeKit delivery email addresses are operator-specific and not shared/resold between NSO customers, the shared address strongly suggests the same Pegasus operator/customer targeted both the Russian/Belarusian civil-society network and a sitting member of the EU body created specifically to investigate spyware abuse.

Apple sent Kouloglou three separate state-sponsored-attacker threat notifications (March 2, 2023; August 29, 2023; and April 10, 2024), none of which he recalls seeing or acting on -- illustrating a recurring gap between vendor threat notifications and real-world remediation among high-risk targets. The case adds to a long pattern of Pegasus and other commercial spyware (Predator/Intellexa, Candiru) being used against PEGA Committee members and associated European political figures, including Carles Puigdemont, Diana Riba, and Jordi Solé (Catalan MEPs targeted 2019-2020, 'CatalanGate'), Nikos Androulakis (Predator), Elena Yoncheva (Pegasus, October 2023), Nathalie Loiseau (Pegasus, February 2024), Daniel Freund (Candiru, May 2024), and Greek journalist Thanasis Koukakis (Intellexa Predator, March 2022). Citizen Lab founder Ron Deibert characterized the likely motive as an attempt to breach parliamentary privilege and monitor the committee's investigation into spyware abuse itself -- a direct challenge to EU efforts at regulatory accountability for the commercial spyware industry. Because Kouloglou's infections occurred while he was interacting with confidential PEGA committee materials, deliberations, and travel logistics, the attacker(s) may have gained visibility into the committee's internal investigative process, sources, and draft findings during a sensitive period of EU spyware-abuse oversight.

## MITRE ATT&CK

- T1589 Gather Victim Identity Information
- T1585 Establish Accounts
- T1664 Exploitation for Initial Access
- T1625.001 System Runtime API Hijacking
- T1624 Event Triggered Execution
- T1541 Foreground Persistence
- T1404 Exploitation for Privilege Escalation
- T1628 Hide Artifacts
- T1630 Indicator Removal on Host
- T1406 Obfuscated Files or Information
- T1420 File and Directory Discovery
- T1421 System Network Connections Discovery
- T1424 Process Discovery
- T1426 System Information Discovery
- T1430 Location Tracking
- T1429 Audio Capture
- T1512 Video Capture
- T1513 Screen Capture
- T1414 Clipboard Data
- T1417 Input Capture
- T1409 Stored Application Data
- T1636 Protected User Data
- T1533 Data from Local System
- T1517 Access Notifications
- T1616 Call Control
- T1437 Application Layer Protocol
- T1509 Non-Standard Port
- T1481 Web Service
- T1544 Ingress Tool Transfer
- T1646 Exfiltration Over C2 Channel

## Sources

- [Pegasus spyware used to target PEGA committee member](https://cyberscoop.com/pegasus-spyware-pega-committee-member-targeted/)
- [Espionage Against the European Parliament: Member of Committee Investigating Spyware Hacked with Pegasus](https://citizenlab.ca/research/member-of-committee-investigating-spyware-hacked-with-pegasus/)
- [Triple Threat: NSO Group's Pegasus Spyware Returns in 2022 with a Trio of iOS 15 and iOS 16 Zero-Click Exploit Chains](https://citizenlab.ca/2023/04/nso-groups-pegasus-spyware-returns-in-2022/)
- [By Whose Authority? Pegasus targeting of Russian & Belarusian-speaking opposition activists and independent media in Europe](https://citizenlab.ca/2024/05/pegasus-russian-belarusian-speaking-opposition-media-europe/)
- [European Parliament Member Investigating Spyware Was Hacked With Pegasus](https://thehackernews.com/2026/07/european-parliament-member.html)
- [EU lawmaker investigating surveillance hacked by Israeli spyware, report says](https://www.aljazeera.com/economy/2026/7/3/eu-lawmaker-investigating-surveillance-hacked-by-israeli-spyware-report-says)
- [Politician who investigated spyware abuses had his phone hacked with Pegasus spyware](https://techcrunch.com/2026/07/02/politician-who-investigated-spyware-abuses-had-his-phone-hacked-with-pegasus-spyware/)
- [Spyware found on phone of European Parliament member probing it](https://therecord.media/pegasus-spyware-european-parliament-pega-committee-member)
- [Pegasus Spyware Hacked MEP Serving on European Parliament PEGA Committee](https://cyberpress.org/pegasus-spyware-hacked-mep/)
- [Former MEP Investigating Spyware Abuses Has Phone Hacked With Pegasus](https://cybersecuritynews.com/mep-investigating-spyware-hacked-pegasus/)
- [Lawmaker Probing Pegasus Spyware Infected Using Same Malware](https://www.bankinfosecurity.com/lawmaker-probing-pegasus-spyware-infected-using-same-malware-a-32153)
- [Report: Pegasus Spyware Targets Exiled Journalists from Russia, Latvia, Belarus](https://cpj.org/2024/05/report-pegasus-spyware-targets-exiled-journalists-from-russia-latvia-belarus/)
- [About the security content of iOS 16.3.1 and iPadOS 16.3.1](https://support.apple.com/en-us/102803)
- [CVE-2023-23529 - Apple WebKit Type Confusion Vulnerability (Actively Exploited)](https://nvd.nist.gov/vuln/detail/cve-2023-23529)
- [Pegasus for iOS, Software S0289](https://attack.mitre.org/software/S0289/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1098