# Pegasus Spyware Used to Hack Phone of Former MEP Stelios Kouloglou, PEGA Committee Member

> Citizen Lab forensic analysis, published by Access Now on July 6, 2026, confirmed that the iPhone of Stelios Kouloglou -- a Greek journalist and former MEP who served on the European Parliament's PEGA Committee investigating spyware abuses -- was infected with NSO Group's Pegasus spyware on October 21, 2022 and again on March 6-7, 2023 via the zero-click PWNYOURHOME exploit chain. The attacker-controlled Apple ID used against Kouloglou (rauharepo888@gmail.com) was previously linked to the 2024 Access Now/Citizen Lab investigation into the hacking of exiled Russian and Belarusian journalists, though Citizen Lab found no evidence implicating the Greek, Russian, or Belarusian governments.

- **Published:** 2026-09-04T00:00:00Z
- **Last reviewed:** 2026-09-04T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2324
- **ID:** TL-2026-2324
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 15 (full data via the Threadlinqs MCP server — Purple tier)

## Description

On July 3, 2026, the Citizen Lab published forensic findings, amplified by an Access Now press release on July 6, 2026, showing that the iPhone of Stelios Kouloglou -- a Greek investigative journalist and former Member of the European Parliament who sat as a substitute member on Parliament's PEGA Committee of Inquiry into Pegasus and equivalent spyware -- was infected twice with NSO Group's Pegasus spyware. The first infection occurred on October 21, 2022 at 10:16 UTC while Kouloglou was hospitalized in Greece; that same day he was visited by fellow Greek journalist Thanasis Koukakis, who one month earlier had testified before the PEGA Committee about his own targeting with Intellexa's Predator spyware. A second infection window ran from March 6 to March 7, 2023 while Kouloglou was in Brussels for parliamentary business. Apple sent Kouloglou threat notifications on March 2, 2023, August 29, 2023, and April 10, 2024.

Both infections were delivered through PWNYOURHOME, a two-stage zero-click exploit chain that NSO Group began deploying against iOS 15 and 16 in October 2022. Citizen Lab's forensic analysis found a lookup for a HomeKit-associated email address, rauharepo888@gmail.com, immediately preceding the point at which a Pegasus process began using the device's mobile data connection -- consistent with the exploit's documented two-phase mechanism: a specially crafted NSKeyedArchive object is delivered to crash Apple's HomeKit daemon, and malicious content is then delivered to crash MessagesBlastDoorService, iMessage's sandboxed content-parsing service, achieving code execution without any interaction from the victim. Kouloglou's device was running iOS 15.5 (build 19F77) during both infection periods. Citizen Lab shared forensic artifacts on the HomeKit component with Apple in January 2023, and Apple shipped a fix in iOS 16.3.1; the MessagesBlastDoorService component had already been mitigated around iOS 16.1. Citizen Lab first disclosed PWNYOURHOME publicly, alongside two sibling zero-click chains (FINDMYPWN and LATENTIMAGE), in its April 18, 2023 'Triple Threat' report.

The forensic link that elevates this case beyond an isolated infection is infrastructure reuse: the same Apple ID, rauharepo888@gmail.com, appears as one of the redacted attacker identifiers in Access Now and Citizen Lab's May 30, 2024 report 'Civil Society in Exile: Pegasus,' which documented at least seven Russian- and Belarusian-speaking journalists and civil society members living in exile across Latvia, Lithuania, and Poland who were targeted with Pegasus between August 2020 and January 2023 -- including Novaya Gazeta Europe CEO Maria Epifanova (infected August 2020, the earliest known Pegasus use against Russian civil society), Israeli-Russian journalist Evgeny Erlikh (infected November 28-29, 2022), Latvian journalist Evgeniy Pavlov (targeted November 2022 and April 2023), and Belarusian opposition figure Andrei Sannikov. Citizen Lab explicitly states it has no evidence implicating the Greek, Russian, or Belarusian governments, but notes that because Kouloglou was infected in both Greece and Belgium, the responsible NSO Group customer likely held a license permitting operations across multiple EU jurisdictions. Kouloglou is the first confirmed PEGA Committee member to have been targeted with spyware during the period he was investigating spyware abuse, an irony that has driven 40+ civil society organizations -- including Access Now, Amnesty International, Privacy International, Reporters Without Borders, the Committee to Protect Journalists, and European Digital Rights -- to jointly demand an independent DG ITEC investigation, accelerated implementation of the PEGA Committee's own recommendations, and stronger enforcement of the EU Dual-Use Regulation against spyware vendors.

## MITRE ATT&CK

- T1456 Drive-By Compromise
- T1664 Exploitation for Initial Access
- T1658 Exploitation for Client Execution
- T1404 Exploitation for Privilege Escalation
- T1645 Compromise Client Software Binary
- T1426 System Information Discovery
- T1421 System Network Connections Discovery
- T1429 Audio Capture
- T1430 Location Tracking
- T1409 Stored Application Data
- T1636.002 Call Log
- T1636.003 Contact List
- T1636.004 SMS Messages
- T1644 Out of Band Data

## Sources

- [Same government, more victims: Access Now calls for an urgent investigation into hacking of MEP](https://www.accessnow.org/press-release/same-government-more-victims-access-now-calls-for-an-urgent-investigation-into-hacking-of-mep/)
- [Espionage Against the European Parliament: Member of Committee Investigating Spyware Hacked with Pegasus](https://citizenlab.ca/research/member-of-committee-investigating-spyware-hacked-with-pegasus/)
- [By Whose Authority? Pegasus Targeting of Russian & Belarusian-Speaking Opposition Media Figures in Europe](https://citizenlab.ca/research/pegasus-russian-belarusian-speaking-opposition-media-europe/)
- [Exiled, then spied on: Civil society in Latvia, Lithuania, and Poland targeted with Pegasus spyware](https://www.accessnow.org/publication/civil-society-in-exile-pegasus/)
- [Joint Statement: Pegasus in the Parliament, the EU Must Act Now](https://securitylab.amnesty.org/latest/2026/07/joint-statement-pegasus-in-the-parliament-the-eu-must-act-now/)
- [Politician who investigated spyware abuses had his phone hacked with Pegasus spyware](https://techcrunch.com/2026/07/02/politician-who-investigated-spyware-abuses-had-his-phone-hacked-with-pegasus-spyware/)
- [Triple Threat: NSO Group's Pegasus Spyware Returns in 2022 with a Trio of iOS 15 and iOS 16 Zero-Click Exploit Chains](https://citizenlab.ca/2023/04/nso-groups-pegasus-spyware-returns-in-2022/)
- [Someone infected a spyware probe overseer with spyware](https://cyberscoop.com/pegasus-spyware-pega-committee-member-targeted/)
- [European Parliament Member Investigating Spyware Was Hacked With Pegasus](https://thehackernews.com/2026/07/european-parliament-member.html)
- [EU urged to act after Pegasus infects phone of spyware inquiry MEP](https://www.theregister.com/security/2026/07/06/eus-latest-spyware-scandal-prompts-calls-for-urgent-action/5267054)
- [NSO Group Used at Least 3 iOS Zero-Click Exploits in 2022: Citizen Lab](https://www.securityweek.com/nso-group-used-at-least-3-ios-zero-click-exploits-in-2022-citizen-lab/)
- [Pegasus spyware targeted exiled journalists from Russia, Latvia, Belarus](https://cpj.org/2024/05/report-pegasus-spyware-targets-exiled-journalists-from-russia-latvia-belarus/)
- [Europe: Brazen hacking of former MEP investigating Pegasus abuses exposes painful inaction over spyware](https://www.amnesty.org/en/latest/news/2026/07/europe-brazen-hacking-of-former-mep-investigating-pegasus-abuses-exposes-painful-inaction-over-spyware/)
- [EU: Russian, Belarusian, Latvian, and Israeli journalists and activists in exile targeted by Pegasus spyware](https://www.business-humanrights.org/en/latest-news/eu-russian-belarusian-latvian-and-israeli-journalists-and-activists-in-exile-targeted-by-pegasus-spyware-4/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2324