Loading story…
Citizen Lab found that the iPhone of former European Parliament member Stelios Kouloglou was infected twice with NSO Group’s Pegasus spyware, in October 2022 and March 2023, while he served on the Parliament’s PEGA Committee investigating spyware abuse across Europe. Researchers said the attacks used a zero-click exploit against an Apple iPhone vulnerability that had been patched but not installed on the device, potentially giving the operator access to private messages, location data, photos, and even ambient audio without any user interaction.
The infections occurred during sensitive PEGA work, including hearings and draft reporting on alleged spyware abuses in Cyprus, Greece, Hungary, Poland, and Spain, intensifying concerns that commercial spyware was used against a lawmaker scrutinizing its misuse. Citizen Lab did not name the government behind the operation, but said the same Pegasus-linked email address and infrastructure overlapped with an earlier cluster targeting Russian- and Belarusian-speaking journalists and opposition figures, strongly suggesting a common operator with cross-border reach; Kouloglou has said he believes he was targeted because of his committee role and plans to sue NSO Group.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
Citizen Lab publicly reported that Stelios Kouloglou, a former member of the European Parliament's PEGA Committee, had been infected with Pegasus spyware while helping investigate spyware abuses in Europe. The report said the same targeting email overlapped with an earlier Pegasus campaign, but did not identify the operator's country.
Citizen Lab linked Kouloglou's case to a previously disclosed cluster of Pegasus attacks against seven Russian- and Belarusian-speaking journalists and opposition figures across Europe. The activity occurred between 2020 and 2023 and used the same targeting email, suggesting a common operator.
Following the disclosure, Kouloglou said he believes he was targeted because of his PEGA committee work and that he plans to sue NSO Group. The statement came alongside broader calls from lawmakers and researchers for stronger action against spyware abuse.
Citizen Lab reported that Apple notified Stelios Kouloglou about mercenary-spyware activity on March 2, 2023, August 29, 2023, and April 10, 2024. The alerts were disclosed as part of Citizen Lab's forensic findings on Pegasus targeting of the former MEP.
Researchers concluded with high confidence that Kouloglou's phone was infected a second time in March 2023. Citizen Lab said both infections were linked to the same Pegasus customer.
Citizen Lab found that former European Parliament member Stelios Kouloglou's iPhone was infected with NSO Group's Pegasus spyware in October 2022 while he was serving on the PEGA Committee. The intrusion reportedly used a zero-click exploit against an Apple iPhone vulnerability.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
9 references tracked. Mallory keeps watching after this page renders.
securityaffairs.com
Open sourcethehackernews.com
Open sourcecybersecuritynews.com
Open sourcecyberscoop.com
Open sourcecitizenlab.ca
Open sourcewired.com
Open sourcetherecord.media
Open sourcebloomberg.com
Open sourcetechcrunch.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Investigations by **Forbidden Stories**, **Amnesty International**, Citizen Lab and major news outlets found that NSO Group’s **Pegasus** spyware was repeatedly used far beyond stated counterterrorism and criminal investigations, with targets including journalists, human rights lawyers, anti-corruption activists, diplomats, aid workers, and political exiles. A leaked dataset of more than **50,000 phone numbers** linked to NSO customers and forensic analysis of examined devices showed confirmed or attempted infections on dozens of phones, including successful compromises of **Apple iPhones**. Reporting tied selections and infections to multiple governments and highlighted targeting of figures around the **Dalai Lama**, overseas numbers used by Americans, and civil society members across countries including Mexico, India, Hungary, Morocco and France. Mexico emerged as one of the clearest examples of abuse, where Pegasus-linked phishing messages and other surveillance tactics were used against prominent reporters, lawyers and activists investigating corruption, human rights abuses and politically sensitive cases. Separate reporting alleged that weak oversight and corruption allowed spyware bought by Mexican authorities to be misused and, in some cases, to reach actors connected to drug cartels, deepening risks for journalists and investigators. NSO denied that the leaked list represented Pegasus targets and said it sells only to vetted governments, but the disclosures prompted warnings about national security risks to U.S. personnel abroad and renewed calls, including from Edward Snowden, for a global crackdown on the commercial spyware trade.
Jul 3, 2026
Amnesty International reported that an employee and a Saudi activist living abroad were targeted with malicious WhatsApp and SMS messages carrying Saudi-themed lures and links tied to infrastructure believed to deliver **NSO Group's Pegasus** spyware. Its investigation identified more than 600 suspicious domains associated with Pegasus's anonymizing transmission network, describing how the platform used social engineering, relay nodes, and exploitation servers to silently compromise mobile devices for full surveillance. NSO said its tools were intended only for government customers investigating crime and terrorism, while Amnesty said the targeting showed abusive use of highly invasive surveillance technology against civil society. Amnesty later documented similar Pegasus activity against Moroccan human rights defenders **Maati Monjib** and **Abdessadak El Bouchattaoui**, who were targeted from at least 2017 through malicious SMS links and suspected mobile network injection attacks. The organization said Monjib's iPhone showed signs consistent with compromise, including Safari redirections to suspicious domains, wiped crash logs, a suspicious process, and a forced reboot, and linked parts of the infrastructure to previously identified NSO systems and a domain associated by Citizen Lab with the Moroccan-linked actor **ATLAS**. The findings, reinforced by broader Citizen Lab reporting on Pegasus operations across dozens of countries, pointed to sustained surveillance of dissidents and rights advocates beyond traditional criminal or counterterrorism use.
Jun 29, 2026
A Greek court sentenced **four Intellexa executives** to **eight years in prison** for their role in the “**Predatorgate**” spyware scandal, which involved use of **Predator** spyware against **90+ public figures**. Prior investigations by **The Citizen Lab** and others documented Predator’s presence in Greece and confirmed infections on devices belonging to journalist **Thanasis Koukakis** and former Meta trust-and-safety manager **Artemis Seaford**, marking a rare case where executives at a mercenary spyware firm faced criminal conviction and prison time. In Italy, prosecutors in Rome and Naples confirmed via a technical report that journalist **Francesco Cancellato** and immigration activists **Giuseppe Caccia** and **Luca Casarini** showed traces consistent with **Paragon Solutions** spyware infections during the early hours of **2024-12-14**, suggesting a coordinated infection campaign. Italian authorities also inspected a Paragon spyware server used by the intelligence agency **AISI** and found evidence of operations against Caccia and Casarini but not against Cancellato, leaving attribution for Cancellato’s compromise unresolved; the case follows **WhatsApp** notifications to roughly **90** people warning they were targeted with Paragon spyware.
Jun 29, 2026