EU Politicians Investigated Pegasus Spyware. Then It Ended Up on One of Their Phones

CommentSave StorySave this story CommentSave StorySave this story “Me being a member of the Pegasus Committee investigating Pegasus and at the same time being hacked by Pegasus,” he says, “it was something really too reckless.” First discovered 2016, Pegasus exploits an evolving set of mobile operating system vulnerabilities to infect both iOS and Android devices with malware that can tap microphones and cameras and grab a target’s messages, contact data, web browsing details, photos, or other personal information . The revelation that Kouloglou’s device was targeted—not once, but multiple times—, created , was published on Friday ’s Citizen Lab. The report, which could send shock waves through political circles in Europe, says it is the first time that a member of the PEGA Committee has been identified as having been a victim of the Pegasus spyware while they were working within the group. The researchers say they do not have conclusive evidence of what government or entity was behind the attacks on Kouloglou’s device, but they note that whoever perpetrated the attacks would have potentially gotten access to internal information about the committee’s activities and findings, potentially violating EU parliamentary confidentiality requirements and people’s privacy. John Scott-Railton, a Citizen Lab senior researcher, emphasizes that while the targeting occurred a few years ago, the irony of the episode underscores how endemic—and brazen—spyware targeting has become in the EU and beyond. “It’s open spyware season on Europe’s lawmakers,” he says. “The European Parliament, national parliaments, nobody is prepared.” NSO, the developer of Pegasus, did not return WIRED’s requests for comment on the findings. NSO was founded in Israel and is still headquartered there, but United States–based investors acquired a majority stake in the company in 2025. The European investigation into the use of Pegasus and other spyware in 2022 was prompted in large part , consisting of research and reporting from more than a dozen media outlets and nongovernment organizations on a huge leak from the NSO Group. The data showed the scale and broad scope of Pegasus use around the world, with at least 180 journalists among those reportedly targeted . NSO Group disputed the findings. Around the same time, Greece was also rocked by a separate spyware scandal, known locally as “Greece’s Watergate,” where dozens of prominent journalists and government and military officials were targeted with the Predator spyware created by Intellexa. Researchers noted at the time that the Pegasus Project showed the need for public-private collaboration and concerted policy efforts to comprehensively address misuse of spyware.