# European Parliament Member Investigating Pegasus Spyware Hacked With Pegasus (PWNYOURHOME Zero-Click Exploit Chain)

> Stelios Kouloglou, a former Member of the European Parliament and substitute member of the PEGA Committee of Inquiry into Pegasus spyware, had his iPhone compromised with NSO Group's Pegasus spyware via the two-phase zero-click PWNYOURHOME exploit chain (HomeKit NSKeyedArchive deserialization followed by MessagesBlastDoorService exploitation) on October 21, 2022 and again March 6-7, 2023. Citizen Lab forensic analysis found a shared attacker-controlled HomeKit lookup identifier linking this intrusion to a Pegasus operator previously documented targeting Russian and Belarusian-speaking exiled journalists and activists in Europe; no government has been attributed and researchers found no evidence implicating Greece.

- **Published:** 2026-07-03T00:00:00Z
- **Last reviewed:** 2026-07-03T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1099
- **ID:** TL-2026-1099
- **Severity:** CRITICAL
- **Category:** ZERO_DAY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 20 (full data via the Threadlinqs MCP server — Purple tier)

## Description

In a research report published July 3, 2026, Citizen Lab disclosed that Stelios Kouloglou -- a Greek investigative journalist and former Member of the European Parliament who served as a substitute member of the PEGA Committee (the European Parliament's Committee of Inquiry to investigate the use of Pegasus and equivalent surveillance spyware) from March 24, 2022 to July 18, 2023 -- was infected with NSO Group's Pegasus mercenary spyware on at least two occasions while the committee was actively investigating spyware abuse in the EU.

Both infections were delivered via PWNYOURHOME, a novel two-phase zero-click exploit chain first documented by Citizen Lab in April 2023 as one of a trio of iOS 15/16 exploit chains NSO Group deployed in 2022 (alongside FINDMYPWN and LATENTIMAGE). PWNYOURHOME begins with a specially crafted NSKeyedArchive object delivered to the device and processed by HomeKit's homed daemon via NSKeyedUnarchiver deserialization -- specifically routed through -[HMDHomeManager _handleHomeDataSync:], which decoded a class not normally used within HomeKit. An attacker-controlled Apple ID/email address is added to the target's HomeKit invitation/lookup state shortly (minutes) before payload execution. The second phase downloads PNG images containing malicious MakerNote metadata through iMessage; parsing these images crashes MessagesBlastDoorService (Apple's iMessage attachment sandbox introduced after FORCEDENTRY) and achieves code execution by repurposing PAC (Pointer Authentication Code)-valid pointers already resident in memory -- e.g., signed pointers to callback functions inside constant structs -- to defeat ARM64e pointer authentication without needing to forge new signed pointers. The payload is subsequently launched via the mediaserverd process.

Kouloglou's device was running iOS 15.5 (build 19F77) -- a version vulnerable to both exploit phases -- during both intrusions. The first infection occurred October 21, 2022 at 10:16 UTC, forensically anchored by a HomeKit lookup for the attacker-controlled identifier rauharepo888@gmail.com, followed roughly two minutes later by anomalous mobile data usage consistent with Pegasus process activity. This infection occurred during a hospital stay and preceded the PEGA Committee's first hearings (October 26-27, 2022) and a committee fact-finding visit to Greece and Cyprus (November 1-4, 2022) by days. A second, forensically similar intrusion -- assessed by Citizen Lab as "likely linked to the same exploit" -- occurred March 6 (09:49) through March 7 (07:30), 2023, during a Brussels visit, again on iOS 15.5 (19F77).

Apple sent Kouloglou state-sponsored threat notifications on three occasions: March 2, 2023 (before he was aware of the specific forensic findings), August 29, 2023, and April 10, 2024. Apple mitigated the HomeKit/homed deserialization issue exploited in PWNYOURHOME's first phase in iOS 16.3.1 (released February 13, 2023) by adding a new method, -[HMDHomeManager _shouldDecodeMessage:error:], that declines to decode HomeKit messages arriving from implausible sources; the MessagesBlastDoorService issue exploited in the second phase was fixed earlier, likely in iOS 16.1 (released October 24, 2022). Citizen Lab shared forensic PWNYOURHOME artifacts with Apple in October 2022 and additional artifacts in January 2023, contributing to the 16.3.1 fix. No CVE identifier is known to have been publicly assigned to either component of the PWNYOURHOME chain. Targets with iOS 16 Lockdown Mode enabled received real-time exploitation warnings during PWNYOURHOME attempts, and Citizen Lab has not observed a successful PWNYOURHOME infection against any device with Lockdown Mode enabled.

The forensically critical link in this report is infrastructure/tradecraft overlap: the same attacker-controlled HomeKit lookup identifier, rauharepo888@gmail.com, used against Kouloglou in October 2022 also appears in Citizen Lab and Access Now's May 30, 2024 joint report, "By Whose Authority? Pegasus Targeting of Russian & Belarusian-Speaking Opposition Activists and Independent Media in Europe," which documented seven Russian- and Belarusian-speaking journalists and activists in Latvia, Poland, and Lithuania targeted and/or infected with Pegasus between August 2020 and January 2023, including Riga-based Russian journalist Maria Epifanova (CEO of Novaya Gazeta Europe, infected August 2020 -- the earliest known Pegasus use against Russian civil society), Warsaw-based exiled Belarusian journalist Natallia Radzina, Warsaw-based Belarusian opposition figure Andrei Sannikov, and Riga-based journalist Evgeny Erlikh. Citizen Lab assesses the shared identifier as "unique to specific operators," indicating the same Pegasus customer/operator targeted both Kouloglou and this cluster of exiled Russian/Belarusian civil-society figures, and that infections spanning multiple EU jurisdictions (Greece and Belgium, plus the earlier Latvia/Poland/Lithuania cases) indicate the responsible NSO customer held a license permitting operations across multiple EU member states.

Citizen Lab explicitly states it is not attributing the Kouloglou infections to a specific NSO Group government customer and found no indications the Greek government is responsible, despite Kouloglou's own public statement to Recorded Future News that he believes the Greek government is responsible. The PEGA Committee adopted its recommendations report on May 8, 2023; the European Commission has been criticized by Citizen Lab researcher John Scott-Railton and other politicians/experts for largely ignoring those recommendations. Citizen Lab's key recommendations include immediate forensic screening of MEPs' and staff devices via the European Parliament's DG ITEC, a formal European Parliament investigation into spyware attacks on its own legislative processes, annual public cyber threat reporting on Parliament security, increased voluntary spyware screening with public statistics, enabling iOS Lockdown Mode / Android Advanced Protection on at-risk devices, and improved UX for state-sponsored threat notifications from platform vendors.

## MITRE ATT&CK

- T1456 Drive-By Compromise
- T1477 Exploit via Radio Interfaces
- T1664 Exploitation for Initial Access
- T1404 Exploitation for Privilege Escalation
- T1624 Event Triggered Execution
- T1628 Hide Artifacts
- T1631 Process Injection
- T1634 Credentials from Password Store
- T1517 Access Notifications
- T1420 File and Directory Discovery
- T1421 System Network Connections Discovery
- T1426 System Information Discovery
- T1636 Protected User Data
- T1414 Clipboard Data
- T1409 Stored Application Data
- T1533 Data from Local System
- T1430 Location Tracking
- T1417 Input Capture
- T1517 Access Notifications
- T1437 Application Layer Protocol
- T1521 Encrypted Channel
- T1646 Exfiltration Over C2 Channel

## Sources

- [Espionage Against the European Parliament: Member of Committee Investigating Spyware Hacked with Pegasus](https://citizenlab.ca/research/member-of-committee-investigating-spyware-hacked-with-pegasus/)
- [European Parliament Member Investigating Spyware Was Hacked With Pegasus](https://thehackernews.com/2026/07/european-parliament-member.html)
- [Triple Threat: NSO Group's Pegasus Spyware Returns in 2022 with a Trio of iOS 15 and iOS 16 Zero-Click Exploit Chains](https://citizenlab.ca/research/nso-groups-pegasus-spyware-returns-in-2022/)
- [By Whose Authority? Pegasus Targeting of Russian & Belarusian-Speaking Opposition Activists and Independent Media in Europe](https://citizenlab.ca/research/pegasus-russian-belarusian-speaking-opposition-media-europe/)
- [Pegasus spyware targeted exiled journalists from Russia, Latvia, Belarus, report finds](https://cpj.org/2024/05/report-pegasus-spyware-targets-exiled-journalists-from-russia-latvia-belarus/)
- [Spyware found on phone of European Parliament member probing it](https://therecord.media/pegasus-spyware-european-parliament-pega-committee-member)
- [Pegasus Spyware Hacked MEP Serving on European Parliament PEGA Committee](https://cyberpress.org/pegasus-spyware-hacked-mep/)
- [NSO zero-click iPhone hack used HomeKit; blocked by Lockdown Mode](https://9to5mac.com/2023/04/18/nso-zero-click-iphone-hack/)
- [NSO Group Used 3 Zero-Click iPhone Exploits Against Human Rights Defenders](https://thehackernews.com/2023/04/nso-group-used-3-zero-click-iphone.html)
- [About the security content of iOS 16.3.1 and iPadOS 16.3.1](https://support.apple.com/en-ae/102803)
- [About the security content of iOS 16.1 and iPadOS 16](https://support.apple.com/en-us/102793)
- [Pegasus for iOS, Software S0289 (MITRE ATT&CK)](https://attack.mitre.org/software/S0289/)
- [Forensic Methodology Report: How to catch NSO Group's Pegasus](https://www.amnesty.org/en/latest/research/2021/07/forensic-methodology-report-how-to-catch-nso-groups-pegasus/)
- [EU lawmakers criticize lack of action to tackle spyware abuses](https://therecord.media/eu-lawmakers-criticize-lack-of-action-on-spyware)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1099