# Pegasus Spyware Used Against Former MEP Stelios Kouloglou While Serving on PEGA Committee

> Citizen Lab forensic analysis confirmed with high confidence that former European Parliament member Stelios Kouloglou, a substitute member of the PEGA Committee investigating spyware abuse, was infected with NSO Group's Pegasus spyware via the PWNYOURHOME zero-click exploit chain on October 21, 2022 and again on March 6-7, 2023. Citizen Lab found no evidence of Greek government involvement but identified an attacker-controlled HomeKit-linked email address that overlaps with a prior Pegasus campaign targeting Russian- and Belarusian-speaking exiled journalists and activists across Europe.

- **Published:** 2026-07-05T00:00:00Z
- **Last reviewed:** 2026-07-05T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1110
- **ID:** TL-2026-1110
- **Severity:** CRITICAL
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 27 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Stelios Kouloglou, a Greek investigative journalist and Member of the European Parliament (2015-2024) who served as a substitute member of the European Parliament's PEGA Committee investigating spyware abuse (March 24, 2022 - July 18, 2023), was targeted twice with NSO Group's Pegasus mercenary spyware while the committee was actively drafting and negotiating its findings on EU spyware abuse.

The first infection occurred on October 21, 2022 while Kouloglou was hospitalized in Greece, ten days before he personally joined a Cyprus-Greece PEGA delegation trip and during the committee's initial report drafting. The second infection occurred March 6-7, 2023 while he traveled from Athens to Brussels during final PEGA report negotiations, overlapping with rapporteur Sophie in 't Veld's delegation visit to Greece. Both infections used the PWNYOURHOME zero-click exploit chain: a specially crafted NSKeyedArchive delivered to the iPhone's HomeKit daemon (homed), triggered via a lookup of the attacker-controlled address rauharepo888@gmail.com (recorded at 2022-10-21 10:16 UTC), followed roughly two minutes later by malicious content landing in MessagesBlastDoorService and observable Pegasus mobile-data network activity. The target device ran iOS 15.5 (build 19F77) at the time of both infections.

PWNYOURHOME was one of three novel NSO zero-click exploit chains publicly disclosed by Citizen Lab in its April 2023 'Triple Threat' report, alongside FINDMYPWN (which abuses the Find My daemon fmfd before pivoting into MessagesBlastDoorService, used against Mexican human-rights defenders at Centro PRODH in mid-2022) and LATENTIMAGE (a low-trace single-case chain observed in January 2022 against an out-of-date iOS 15.1.1 device). All three chains circumvent Apple's Pointer Authentication Code (PAC) mitigations by repurposing known-offset signed pointers already present in the iOS shared cache, allowing code execution despite modern exploit mitigations. Apple addressed the HomeKit vector in iOS 16.3.1 and the MessagesBlastDoorService vector earlier, around iOS 16.1.

Citizen Lab's attribution assessment states explicitly that it is 'not attributing these infections to a particular government at this time' and found 'no indications that the Greek Government is responsible' and no indication Greece has ever been an NSO Group customer. However, the rauharepo888@gmail.com HomeKit identifier used against Kouloglou reappears as a redacted Apple ID in Citizen Lab and Access Now's May 2024 report 'By Whose Authority?' documenting Pegasus targeting of at least seven Russian- and Belarusian-speaking exiled journalists and opposition activists across Latvia, Lithuania, and Poland between 2020 and 2023 (including Maria Epifanova, Natalya Radina, and Evgeniy Erlich), suggesting a single NSO customer operating with multi-country licensing across EU jurisdictions. Kouloglou received Apple threat notifications on March 2, 2023, August 29, 2023, and April 10, 2024 -- each arriving months after the actual targeting, consistent with Apple's standard batch-notification delay.

Kouloglou is the first publicly identified PEGA Committee member confirmed compromised while actively serving on the inquiry into spyware abuses, but not the only one: PEGA Committee Chair Nathalie Loiseau, Vice-Chair Diana Riba, substitute member Jordi Sole, and member Carles Puigdemont were all separately confirmed as Pegasus targets (the latter three tied to the 'CatalanGate' campaign against Catalan independence figures), Bulgarian MEP Elena Yoncheva was targeted with Pegasus in late October 2023, and German MEP Daniel Freund disclosed targeting with Candiru spyware in May 2024. The case sits alongside Greece's own domestic 'Predatorgate' scandal, in which Intellexa's Predator spyware (a different vendor and platform) was used to surveil PASOK leader and MEP Nikos Androulakis and journalist Thanasis Koukakis -- underscoring that the European Parliament's own spyware-oversight body has been a persistent, cross-vendor surveillance target throughout its mandate. Citizen Lab director Ron Deibert characterized the likely intent as an effort to 'breach parliamentary privilege and find out what was going on in that committee.' The PEGA Committee's final report, which produced recommendations for tighter EU controls on spyware sales and use, saw no binding follow-up action in the European Parliament.

## MITRE ATT&CK

- T1583 Acquire Infrastructure
- T1588 Obtain Capabilities
- T1585 Establish Accounts
- T1456 Drive-By Compromise
- T1404 Exploitation for Privilege Escalation
- T1407 Download New Code at Runtime
- T1631 Process Injection
- T1629 Impair Defenses
- T1517 Access Notifications
- T1426 System Information Discovery
- T1421 System Network Connections Discovery
- T1424 Process Discovery
- T1420 File and Directory Discovery
- T1636 Protected User Data
- T1429 Audio Capture
- T1512 Video Capture
- T1430 Location Tracking
- T1414 Clipboard Data
- T1533 Data from Local System
- T1409 Stored Application Data
- T1616 Call Control
- T1521 Encrypted Channel
- T1637 Dynamic Resolution
- T1646 Exfiltration Over C2 Channel
- T1639 Exfiltration Over Alternative Protocol

## Sources

- [Espionage Against the European Parliament: Member of Committee Investigating Spyware Hacked with Pegasus](https://citizenlab.ca/research/member-of-committee-investigating-spyware-hacked-with-pegasus/)
- [Triple Threat: NSO Group's Pegasus Spyware Returns in 2022 with a Trio of iOS 15 and iOS 16 Zero-Click Exploit Chains](https://citizenlab.ca/2023/04/nso-groups-pegasus-spyware-returns-in-2022/)
- [By Whose Authority? Pegasus targeting of Russian & Belarusian-speaking opposition activists and independent media in Europe](https://citizenlab.ca/2024/05/pegasus-russian-belarusian-speaking-opposition-media-europe/)
- [Former MEP Investigating Spyware Abuses Has Phone Hacked With Pegasus](https://cybersecuritynews.com/mep-investigating-spyware-hacked-pegasus/)
- [European Parliament Member Investigating Spyware Was Hacked With Pegasus](https://thehackernews.com/2026/07/european-parliament-member.html)
- [Someone infected a spyware probe overseer with spyware](https://cyberscoop.com/pegasus-spyware-pega-committee-member-targeted/)
- [Pegasus Used Against MEP Investigating Pegasus, Citizen Lab Finds](https://securityaffairs.com/194728/malware/pegasus-used-against-mep-investigating-pegasus-citizen-lab-finds.html)
- [Pegasus Spyware Hacked European Parliament Member Investigating Spyware Abuse](https://gbhackers.com/pegasus-spyware-hacked-european-parliament/)
- [Pegasus Spyware Hacked MEP Serving on European Parliament PEGA Committee](https://cyberpress.org/pegasus-spyware-hacked-mep/)
- [Former MEP Investigating Spyware Abuses Has Phone Hacked With Pegasus](https://www.cryptika.com/former-mep-investigating-spyware-abuses-has-phone-hacked-with-pegasus/)
- [NSO zero-click iPhone hack used HomeKit; blocked by Lockdown Mode](https://9to5mac.com/2023/04/18/nso-zero-click-iphone-hack/)
- [NSO Group escalates spyware tactics with 3 new iPhone zero-click exploit chains](https://www.scworld.com/news/nso-group-iphone-zero-click-exploit)
- [Zero-Click iPhone Exploit Drops Pegasus Spyware on Exiled Russian Journalist](https://www.darkreading.com/endpoint-security/nation-state-actor-used-0-click-exploit-to-drop-pegasus-spyware-on-russian-journalist-s-iphone)
- [NSO Group Used at Least 3 iOS Zero-Click Exploits in 2022: Citizen Lab](https://www.securityweek.com/nso-group-used-at-least-3-ios-zero-click-exploits-in-2022-citizen-lab/)
- [Pegasus spyware targeted exiled journalists from Russia, Latvia, Belarus, report finds](https://cpj.org/2024/05/report-pegasus-spyware-targets-exiled-journalists-from-russia-latvia-belarus/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1110