Threat reportSurveillanceTL-2026-1193
Pegasus Spyware Re-Targets EU Parliamentarian: Stelios Kouloglou Hacked via PWNYOURHOME Zero-Click Chain While Investigating Spyware Abuse on PEGA Committee
Pegasus Spyware Re-Targets EU Parliamentarian (TL-2026-1193), also tracked as PWNYOURHOME, is a high-severity surveillance threat, first published 2026-07-10. It is attributed to NSO Group Pegasus customer with low confidence, affects Apple iOS, maps to 20 MITRE ATT&CK techniques (T1005, T1027, T1041), and is covered by 9 detection rules and 22 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 20MITRE ATT&CK
- Actors
- 1NSO Group Pegasus customer
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 22Indicators of compromise
Key facts for TL-2026-1193
- Threat ID
- TL-2026-1193
- Also known as
- PWNYOURHOME, Espionage Against the European Parliament
- Severity
- HIGH
- Status
- ACTIVE
- Category
- SURVEILLANCE
- First published
- Last reviewed
- Attribution
- NSO Group Pegasus customer
- Attribution confidence
- LOW
- Motivation
- ESPIONAGE
- Target sectors
- government administration, news - media, civil society, human-rights, legal
- Target regions
- greece, belgium, European Union, latvia, poland, lithuania, russia, belarus
- Detection rules
- 9
- Indicators of compromise
- 22
Malware and tooling in Pegasus Spyware Re-Targets EU Parliamentarian
Malware and tooling: Chrysaor, FINDMYPWN, FORCEDENTRY, LATENTIMAGE, PWNYOURHOME, Mobile Verification Toolkit (MVT)
How Pegasus Spyware Re-Targets EU Parliamentarian works
Citizen Lab forensics confirmed that former Greek MEP and journalist Stelios Kouloglou's iPhone was infected with NSO Group's Pegasus spyware on October 21, 2022 and again on March 6-7, 2023, while he served as a substitute member of the European Parliament's PEGA Committee investigating spyware abuse. The HomeKit attacker artifact matches infrastructure from a 2024 Citizen Lab/Access Now report on Pegasus targeting of exiled Russian and Belarusian journalists and activists, and the case has renewed civil-society pressure on the EU to act on the PEGA Committee's 2023 recommendations and reform the bloc's Dual-Use Regulation for spyware exports.
On July 3-4, 2026, the Citizen Lab published forensic findings that Stelios Kouloglou -- a former investigative journalist and Greek Member of the European Parliament (2014-2023) who served as a substitute member of the Parliament's Committee of Inquiry to investigate the use of Pegasus and equivalent surveillance spyware (PEGA Committee) from March 24, 2022 to July 18, 2023 -- was infected twice with NSO Group's Pegasus spyware on his personal iPhone (running iOS 15.5, build 19F77).
The first infection occurred on October 21, 2022 at 10:16 AM while Kouloglou was in a Greek hospital undergoing elective surgery. Forensic artifacts show a HomeKit-directed email lookup for the attacker-controlled address rauharepo888@gmail.com immediately preceded a Pegasus process consuming mobile data, consistent with NSO Group's PWNYOURHOME zero-click exploit chain: a specially crafted NSKeyedArchive payload is sent to Apple's HomeKit daemon (homed), a deserialization anomaly and Pointer Authentication Code (PAC) bypass are used to gain initial code execution, and a second-stage payload is subsequently routed through MessagesBlastDoorService (iMessage) to escape the BlastDoor sandbox and ultimately launch Pegasus via the mediaserverd process. Apple mitigated the HomeKit component in iOS 16.3.1 (adding a `_shouldDecodeMessage:error:` validation method) and the MessagesBlastDoorService component earlier, likely in iOS 16.1. This first infection occurred ten days before a scheduled November 1-4, 2022 PEGA Committee delegation visit to Cyprus and Greece, during preparation for October 26-27 hearings, and while the first PEGA draft report (delivered November 8, 2022) was circulating among committee members.
The second infection occurred in a window from March 6, 09:49 to March 7, 07:30, 2023, after Kouloglou traveled from Athens to Brussels on March 6; Citizen Lab assessed it as "likely linked to the same exploit" as the October 2022 incident. This coincided with intensive PEGA Committee final-drafting discussions roughly two months ahead of the May 8, 2023 adoption of the first PEGA report, and overlapped with PEGA Rapporteur MEP Sophie in 't Veld's concurrent LIBE Committee mission to Greece (March 6-8, 2023). Apple separately issued Kouloglou three threat notifications -- March 2, 2023, August 29, 2023, and April 10, 2024 -- none of which he recalled receiving, illustrating gaps in state-sponsored-attacker notification delivery and awareness.
Citizen Lab could not attribute either infection to a specific NSO Group customer, but found no evidence implicating the Greek government (which has no known NSO Group license and has been separately and extensively documented abusing Intellexa's Predator spyware against journalists and politicians). Instead, the same attacker email artifact (rauharepo888@gmail.com) matches "Email 1" identified in Citizen Lab and Access Now's May 2024 joint report, "By Whose Authority? Pegasus Targeting of Russian & Belarusian-Speaking Opposition Activists and Independent Media in Europe," which documented hacking between August 2020 and January 2023 of seven Russian- and Belarusian-speaking exiled journalists and opposition activists based in Latvia, Poland, and Lithuania -- including Novaya Gazeta Europe director Maria Epifanova (infected August 2020, the earliest known Pegasus use against Russian civil society), Charter97.org editor Natallia Radzina (infected twice in December 2022 and once in January 2023), RFE/RL journalist Evgeny Pavlov (targeted November 2022 and April 2023), RFE/RL journalist Evgeny Erlikh, and Belarusian opposition politician Andrei Sannikov (infected September 7, 2021). Because the confirmed infections span both Greek and Belgian jurisdictions, Citizen Lab assesses "the customer had a license that enabled infections in multiple EU jurisdictions."
PWNYOURHOME is one of three novel zero-click iOS exploit chains Citizen Lab documented resurfacing in NSO Group's 2022 arsenal (detailed in the April 2023 report "Triple Threat"), alongside FINDMYPWN (chaining the Find My daemon fmfd with MessagesBlastDoorService, deployed against Mexican human-rights organization Centro PRODH staff from June 2022) and LATENTIMAGE (a single documented January 2022 case launching Pegasus via springboard rather than mediaserverd). All three represent an evolution from the single-process FORCEDENTRY (2021) exploit toward multi-surface, two-phase zero-click chains -- PWNYOURHOME and FINDMYPWN are described as "the first zero-click exploits... that make use of two separate remote attack surfaces on the iPhone."
The case is the first public identification of a sitting PEGA Committee member being targeted with Pegasus while actively serving on the committee investigating spyware abuse, and follows a long list of previously confirmed Pegasus/Predator/Candiru infections of European Parliament members and national officials: Catalan MEPs Diana Riba (Oct 2019), Jordi Solé (Jun 2020), Clara Ponsati (via staff, Jul 2020), and Carles Puigdemont (Oct 2019 and Jul 2020); Bulgarian MEP Elena Yoncheva (Oct 2023, Pegasus); French MEP Nathalie Loiseau of the Security/Defence subcommittee (Feb 2024, Pegasus); and German MEP Daniel Freund (May 2024, Candiru). Prior national scandals include Greece's Predator campaign against journalist Thanasis Koukakis and MEP Nikos Androulakis and 87 other high-profile Greeks (2022, with four Intellexa-connected individuals sentenced to 126+ years each in February 2026); Spain's CatalanGate (65+ Catalan separatist figures infected 2017-2020, including then-PM Pedro Sánchez, leading to the dismissal of intelligence director Paz Esteban López); Poland's targeting of opposition figures under the PiS government (former intelligence officials and ministers charged February 2026); and Hungary's 2021 Pegasus use against journalists, lawyers, and politicians.
Amnesty International's Security Lab, the Center for Democracy & Technology (CDT), and European Digital Rights (EDRi) issued a joint statement following the disclosure calling for a robust investigation by the European Parliament's Directorate-General for Innovation and Technological Support (DG ITEC), a public EU response to the PEGA Committee's May 2023 recommendations (regulate rather than ban EU spyware sales, require Europol involvement for lawful use, mandate independent oversight, and obligate thorough abuse investigations), effective remedies for victims (including evidence access and surveillance notification), and reform of the EU's 2021 Dual-Use Regulation governing spyware exports. Amnesty's Elina Castillo Jiménez stated: "The brazen targeting of someone in his position underlines how inadequate the current system is."
MITRE ATT&CK techniques used in TL-2026-1193
Collection
T1005 Data from Local System; T1056 Input Capture; T1114 Email Collection; T1123 Audio Capture; T1125 Video Capture
Defense Evasion
T1027 Obfuscated Files or Information; T1211 Exploitation for Stealth
Exfiltration
T1041 Exfiltration Over C2 Channel
Privilege Escalation
T1068 Exploitation for Privilege Escalation
Command and Control
T1071 Application Layer Protocol; T1102 Web Service; T1573 Encrypted Channel
Discovery
T1082 System Information Discovery
Initial Access
T1190 Exploit Public-Facing Application
Execution
T1203 Exploitation for Client Execution
Persistence
T1543 Create or Modify System Process
Resource Development
T1583 Acquire Infrastructure; T1584 Compromise Infrastructure; T1588 Obtain Capabilities
Reconnaissance
Affected products and versions in Pegasus Spyware Re-Targets EU Parliamentarian
- Apple — iOS
Vulnerable versions: iOS 15.5 (19F77); iOS 15.6; iOS 16.0.3; iOS 15 and 16 builds prior to 16.3.1
Fixed in: iOS 16.3.1 (HomeKit component); iOS 16.1 (MessagesBlastDoorService component) - Apple — HomeKit (homed daemon)
Vulnerable versions: iOS builds prior to 16.3.1
Fixed in: iOS 16.3.1 - Apple — Messages / MessagesBlastDoorService
Vulnerable versions: iOS builds prior to 16.1
Fixed in: iOS 16.1
Remediation for Pegasus Spyware Re-Targets EU Parliamentarian
Patches
- iOS 16.3.1 (HomeKit / homed validation fix, `_shouldDecodeMessage:error:`)
- iOS 16.1 (MessagesBlastDoorService hardening, addressed prior to public PWNYOURHOME disclosure)
Immediate actions
- Apply iOS 16.3.1 or later, which mitigates the HomeKit component of PWNYOURHOME
- Enable Apple Lockdown Mode on devices belonging to journalists, activists, politicians, and human-rights defenders at elevated risk
- Run Mobile Verification Toolkit (MVT) forensic triage on devices belonging to individuals in high-risk roles (parliamentarians, journalists, activists, lawyers)
- Treat any Apple threat notification as credible and act immediately (image/device isolation, forensic capture) rather than dismissing as a false positive
- Flag and investigate any device communication with rauharepo888@gmail.com or related attacker-controlled Apple IDs
Workarounds
- Enable Lockdown Mode, which surfaces attempted PWNYOURHOME-style attacks via user-visible notifications
- Segregate high-risk individuals' devices from HomeKit and disable Find My sharing where not operationally required
- Periodic reboot of iOS devices to disrupt non-persistent zero-click implants pending forensic review
Longer-term hardening
- EU-wide reform of the 2021 Dual-Use Regulation to close spyware export-control gaps
- Implement the PEGA Committee's May 2023 recommendations: regulate (not merely tolerate) EU spyware sales, mandate Europol involvement in lawful-intercept licensing, require independent oversight bodies, and obligate abuse investigations
- Establish EU/member-state victim notification and remedy mechanisms for confirmed spyware targeting of officials and civil society
- Restrict or suspend commercial spyware licensing to EU member states pending independent oversight reforms
Weaknesses (CWE) in Pegasus Spyware Re-Targets EU Parliamentarian
Timeline of Pegasus Spyware Re-Targets EU Parliamentarian
- Catalan MEP Diana Riba's device is infected with Pegasus, part of the earlier CatalanGate campaign later documented by Citizen Lab.
- Novaya Gazeta Europe director Maria Epifanova, exiled in Latvia, is infected with Pegasus -- the earliest known use of Pegasus against Russian civil society, per Citizen Lab/Access Now.
- Belarusian opposition politician Andrei Sannikov's iPhone is infected with Pegasus.
- NSO Group's FINDMYPWN zero-click exploit chain (Find My daemon + MessagesBlastDoorService) is deployed against staff of Mexican human-rights organization Centro PRODH.
- Stelios Kouloglou's iPhone (iOS 15.5, 19F77) is infected with Pegasus via the PWNYOURHOME zero-click chain while he is in a Greek hospital; a HomeKit email lookup for rauharepo888@gmail.com precedes the Pegasus process by two minutes.
- The PEGA Committee's first draft report is delivered, ten days after a delegation visit to Cyprus and Greece and roughly two and a half weeks after Kouloglou's first infection.
- Exiled Belarusian journalist Natallia Radzina, based in Warsaw, is infected with Pegasus twice in December 2022, the first infection occurring the day after an anti-war conference in Vilnius.
- Natallia Radzina is infected with Pegasus a third time in January 2023, closing out the documented Russian/Belarusian opposition targeting window (Aug 2020-Jan 2023).
- Apple issues Kouloglou the first of three state-sponsored-attacker threat notifications; he does not recall receiving it.
- Kouloglou's iPhone is infected a second time in Brussels (window: March 6, 09:49 to March 7, 07:30), assessed as likely the same exploit as the October 2022 infection, overlapping with PEGA Rapporteur Sophie in 't Veld's LIBE Committee mission to Greece.
- The European Parliament's PEGA Committee adopts its first report, recommending regulation (not prohibition) of EU spyware sales, mandatory Europol involvement, independent oversight, and abuse investigations.
- Kouloglou's tenure as a substitute member of the PEGA Committee ends.
- Apple issues Kouloglou a second threat notification.
- Apple issues Kouloglou a third threat notification.
- Citizen Lab and Access Now jointly publish "By Whose Authority?", documenting Pegasus targeting of seven Russian- and Belarusian-speaking exiled journalists and activists -- later found to share the same attacker email artifact as the Kouloglou case.
- Kouloglou brings his iPhone to Citizen Lab for forensic examination.
- Citizen Lab publishes "Espionage Against the European Parliament," confirming both Kouloglou infections and linking them to the 2024 Russian/Belarusian opposition targeting campaign; Amnesty, CDT, and EDRi issue a joint statement calling for EU action.
Sources cited for Pegasus Spyware Re-Targets EU Parliamentarian
- Espionage Against the European Parliament: Member of Committee Investigating Spyware Hacked with Pegasus
- By Whose Authority? Pegasus Targeting of Russian & Belarusian-Speaking Opposition Activists and Independent Media in Europe
- Triple Threat: NSO Group's Pegasus Spyware Returns in 2022 with a Trio of iOS 15 and iOS 16 Zero-Click Exploit Chains
- EU's latest spyware scandal prompts calls for urgent action
- Joint Statement: Pegasus in the European Parliament, the EU Must Act Now
- Joint Statement: Pegasus in the parliament, the EU must act now
- Joint Statement: Pegasus in the European Parliament, the EU Must Act Now (EDRi)
- EU lawmaker investigating surveillance hacked by Israeli spyware, report says
- European Parliament Member Investigating Spyware Was Hacked With Pegasus
- Spyware found on phone of European Parliament member probing it
- Report: Pegasus spyware targets exiled journalists from Russia, Latvia, Belarus
Detection coverage for TL-2026-1193
As of 2026-07-10, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1193 across Splunk SPL, Microsoft KQL and Sigma, covering 22 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.