# Pegasus Spyware Re-Targets EU Parliamentarian: Stelios Kouloglou Hacked via PWNYOURHOME Zero-Click Chain While Investigating Spyware Abuse on PEGA Committee

> Citizen Lab forensics confirmed that former Greek MEP and journalist Stelios Kouloglou's iPhone was infected with NSO Group's Pegasus spyware on October 21, 2022 and again on March 6-7, 2023, while he served as a substitute member of the European Parliament's PEGA Committee investigating spyware abuse. The HomeKit attacker artifact matches infrastructure from a 2024 Citizen Lab/Access Now report on Pegasus targeting of exiled Russian and Belarusian journalists and activists, and the case has renewed civil-society pressure on the EU to act on the PEGA Committee's 2023 recommendations and reform the bloc's Dual-Use Regulation for spyware exports.

- **Published:** 2026-07-10T00:00:00Z
- **Last reviewed:** 2026-07-10T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1193
- **ID:** TL-2026-1193
- **Severity:** HIGH
- **Category:** SURVEILLANCE
- **Status:** ACTIVE
- **Actor:** NSO Group Pegasus customer
- **Detections:** 9 · **IOCs:** 22 (full data via the Threadlinqs MCP server — Purple tier)

## Description

On July 3-4, 2026, the Citizen Lab published forensic findings that Stelios Kouloglou -- a former investigative journalist and Greek Member of the European Parliament (2014-2023) who served as a substitute member of the Parliament's Committee of Inquiry to investigate the use of Pegasus and equivalent surveillance spyware (PEGA Committee) from March 24, 2022 to July 18, 2023 -- was infected twice with NSO Group's Pegasus spyware on his personal iPhone (running iOS 15.5, build 19F77).

The first infection occurred on October 21, 2022 at 10:16 AM while Kouloglou was in a Greek hospital undergoing elective surgery. Forensic artifacts show a HomeKit-directed email lookup for the attacker-controlled address rauharepo888@gmail.com immediately preceded a Pegasus process consuming mobile data, consistent with NSO Group's PWNYOURHOME zero-click exploit chain: a specially crafted NSKeyedArchive payload is sent to Apple's HomeKit daemon (homed), a deserialization anomaly and Pointer Authentication Code (PAC) bypass are used to gain initial code execution, and a second-stage payload is subsequently routed through MessagesBlastDoorService (iMessage) to escape the BlastDoor sandbox and ultimately launch Pegasus via the mediaserverd process. Apple mitigated the HomeKit component in iOS 16.3.1 (adding a `_shouldDecodeMessage:error:` validation method) and the MessagesBlastDoorService component earlier, likely in iOS 16.1. This first infection occurred ten days before a scheduled November 1-4, 2022 PEGA Committee delegation visit to Cyprus and Greece, during preparation for October 26-27 hearings, and while the first PEGA draft report (delivered November 8, 2022) was circulating among committee members.

The second infection occurred in a window from March 6, 09:49 to March 7, 07:30, 2023, after Kouloglou traveled from Athens to Brussels on March 6; Citizen Lab assessed it as "likely linked to the same exploit" as the October 2022 incident. This coincided with intensive PEGA Committee final-drafting discussions roughly two months ahead of the May 8, 2023 adoption of the first PEGA report, and overlapped with PEGA Rapporteur MEP Sophie in 't Veld's concurrent LIBE Committee mission to Greece (March 6-8, 2023). Apple separately issued Kouloglou three threat notifications -- March 2, 2023, August 29, 2023, and April 10, 2024 -- none of which he recalled receiving, illustrating gaps in state-sponsored-attacker notification delivery and awareness.

Citizen Lab could not attribute either infection to a specific NSO Group customer, but found no evidence implicating the Greek government (which has no known NSO Group license and has been separately and extensively documented abusing Intellexa's Predator spyware against journalists and politicians). Instead, the same attacker email artifact (rauharepo888@gmail.com) matches "Email 1" identified in Citizen Lab and Access Now's May 2024 joint report, "By Whose Authority? Pegasus Targeting of Russian & Belarusian-Speaking Opposition Activists and Independent Media in Europe," which documented hacking between August 2020 and January 2023 of seven Russian- and Belarusian-speaking exiled journalists and opposition activists based in Latvia, Poland, and Lithuania -- including Novaya Gazeta Europe director Maria Epifanova (infected August 2020, the earliest known Pegasus use against Russian civil society), Charter97.org editor Natallia Radzina (infected twice in December 2022 and once in January 2023), RFE/RL journalist Evgeny Pavlov (targeted November 2022 and April 2023), RFE/RL journalist Evgeny Erlikh, and Belarusian opposition politician Andrei Sannikov (infected September 7, 2021). Because the confirmed infections span both Greek and Belgian jurisdictions, Citizen Lab assesses "the customer had a license that enabled infections in multiple EU jurisdictions."

PWNYOURHOME is one of three novel zero-click iOS exploit chains Citizen Lab documented resurfacing in NSO Group's 2022 arsenal (detailed in the April 2023 report "Triple Threat"), alongside FINDMYPWN (chaining the Find My daemon fmfd with MessagesBlastDoorService, deployed against Mexican human-rights organization Centro PRODH staff from June 2022) and LATENTIMAGE (a single documented January 2022 case launching Pegasus via springboard rather than mediaserverd). All three represent an evolution from the single-process FORCEDENTRY (2021) exploit toward multi-surface, two-phase zero-click chains -- PWNYOURHOME and FINDMYPWN are described as "the first zero-click exploits... that make use of two separate remote attack surfaces on the iPhone."

The case is the first public identification of a sitting PEGA Committee member being targeted with Pegasus while actively serving on the committee investigating spyware abuse, and follows a long list of previously confirmed Pegasus/Predator/Candiru infections of European Parliament members and national officials: Catalan MEPs Diana Riba (Oct 2019), Jordi Solé (Jun 2020), Clara Ponsati (via staff, Jul 2020), and Carles Puigdemont (Oct 2019 and Jul 2020); Bulgarian MEP Elena Yoncheva (Oct 2023, Pegasus); French MEP Nathalie Loiseau of the Security/Defence subcommittee (Feb 2024, Pegasus); and German MEP Daniel Freund (May 2024, Candiru). Prior national scandals include Greece's Predator campaign against journalist Thanasis Koukakis and MEP Nikos Androulakis and 87 other high-profile Greeks (2022, with four Intellexa-connected individuals sentenced to 126+ years each in February 2026); Spain's CatalanGate (65+ Catalan separatist figures infected 2017-2020, including then-PM Pedro Sánchez, leading to the dismissal of intelligence director Paz Esteban López); Poland's targeting of opposition figures under the PiS government (former intelligence officials and ministers charged February 2026); and Hungary's 2021 Pegasus use against journalists, lawyers, and politicians.

Amnesty International's Security Lab, the Center for Democracy & Technology (CDT), and European Digital Rights (EDRi) issued a joint statement following the disclosure calling for a robust investigation by the European Parliament's Directorate-General for Innovation and Technological Support (DG ITEC), a public EU response to the PEGA Committee's May 2023 recommendations (regulate rather than ban EU spyware sales, require Europol involvement for lawful use, mandate independent oversight, and obligate thorough abuse investigations), effective remedies for victims (including evidence access and surveillance notification), and reform of the EU's 2021 Dual-Use Regulation governing spyware exports. Amnesty's Elina Castillo Jiménez stated: "The brazen targeting of someone in his position underlines how inadequate the current system is."

## MITRE ATT&CK

- T1589 Gather Victim Identity Information
- T1583 Acquire Infrastructure
- T1588 Obtain Capabilities
- T1584 Compromise Infrastructure
- T1190 Exploit Public-Facing Application
- T1203 Exploitation for Client Execution
- T1068 Exploitation for Privilege Escalation
- T1211 Exploitation for Stealth
- T1027 Obfuscated Files or Information
- T1543 Create or Modify System Process
- T1082 System Information Discovery
- T1114 Email Collection
- T1005 Data from Local System
- T1123 Audio Capture
- T1125 Video Capture
- T1056 Input Capture
- T1071 Application Layer Protocol
- T1573 Encrypted Channel
- T1102 Web Service
- T1041 Exfiltration Over C2 Channel

## Sources

- [Espionage Against the European Parliament: Member of Committee Investigating Spyware Hacked with Pegasus](https://citizenlab.ca/research/member-of-committee-investigating-spyware-hacked-with-pegasus/)
- [By Whose Authority? Pegasus Targeting of Russian & Belarusian-Speaking Opposition Activists and Independent Media in Europe](https://citizenlab.ca/research/pegasus-russian-belarusian-speaking-opposition-media-europe/)
- [Triple Threat: NSO Group's Pegasus Spyware Returns in 2022 with a Trio of iOS 15 and iOS 16 Zero-Click Exploit Chains](https://citizenlab.ca/2023/04/nso-groups-pegasus-spyware-returns-in-2022/)
- [EU's latest spyware scandal prompts calls for urgent action](https://www.theregister.com/security/2026/07/06/eus-latest-spyware-scandal-prompts-calls-for-urgent-action/5267054)
- [Joint Statement: Pegasus in the European Parliament, the EU Must Act Now](https://cdt.org/insights/joint-statement-pegasus-in-the-european-parliament-the-eu-must-act-now/)
- [Joint Statement: Pegasus in the parliament, the EU must act now](https://securitylab.amnesty.org/latest/2026/07/joint-statement-pegasus-in-the-parliament-the-eu-must-act-now/)
- [Joint Statement: Pegasus in the European Parliament, the EU Must Act Now (EDRi)](https://edri.org/our-work/joint-statement-pegasus-in-the-european-parliament-the-eu-must-act-now/)
- [EU lawmaker investigating surveillance hacked by Israeli spyware, report says](https://www.aljazeera.com/economy/2026/7/3/eu-lawmaker-investigating-surveillance-hacked-by-israeli-spyware-report-says)
- [European Parliament Member Investigating Spyware Was Hacked With Pegasus](https://thehackernews.com/2026/07/european-parliament-member.html)
- [Spyware found on phone of European Parliament member probing it](https://therecord.media/pegasus-spyware-european-parliament-pega-committee-member)
- [Report: Pegasus spyware targets exiled journalists from Russia, Latvia, Belarus](https://cpj.org/2024/05/report-pegasus-spyware-targets-exiled-journalists-from-russia-latvia-belarus/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1193