A lawmaker investigating spyware got hacked with the exact spyware he was investigating
Stelios Kouloglou sat on the European Parliament's committee probing Pegasus. Citizen Lab found Pegasus on his iPhone — twice, timed to the committee's hearings. And the forensic trail points not at a foreign enemy but at a European state.
Citizen Lab reports that Kouloglou — Greek journalist, former MEP, substitute member of the Parliament's PEGA spyware inquiry — had his iPhone infected with NSO Group's Pegasus around October 2022 and again March 2023, timed to hearings and the final report. No specific government is named, but the operator overlaps with one that targeted exiled Russian and Belarusian journalists.
The thread reframes it: this may be an EU member state spying on the EU's own investigators — the calls coming from inside the house.
The forensic timeline
Citizen Lab's report, *Member of Committee Investigating Spyware Hacked with Pegasus*, documents the infection of Stelios Kouloglou — a Greek investigative journalist and former MEP who was a substitute member of the Parliament's PEGA committee, the inquiry into Pegasus and mercenary spyware. Forensic analysis found high-confidence infections around 21 October 2022 and again 6–7 March 2023, each aligned with PEGA hearings and the drafting of its final report (adopted 8 May 2023). Apple's threat notifications reached him repeatedly across 2023–2024. Researchers did not attribute the attack to a specific government, and found no indication Greece was responsible — but noted an overlap with an operator previously seen targeting Russian- and Belarusian-speaking exiled journalists, implying a customer authorized to spy across multiple European countries. It appears to be the first publicly identified hack of a PEGA member during the committee's own work.
The calls from inside the house
The thread pushed against the 'espionage against Europe' framing — from the direction of who was likely holding the tool:
"Around that time a lot of politicians in Greece had their phones hacked by Pegasus… all evidence indicate that it was an operation orchestrated by the office of the prime minister… So I wouldn't call that an attack against the European parliament." — a commenter in Greece placing it as a domestic scandal
Others filled in the attribution Citizen Lab withheld, citing prior reporting that Estonia and the Netherlands have used Pegasus beyond their borders. And one reader moved the story from espionage sophistication to plain operational failure:
"they imply that both confidential personal medical information and confidential gov docs might have been compromised via the same phone. Does EU parliment not have a policy of seperating work and personal devices?" — an open-source contributor on the opsec lapse
The uncomfortable synthesis: the body that spent a year investigating who in Europe deploys mercenary spyware may have been surveilled, mid-investigation, by one of Europe's own governments — and the victim's mixing of medical and official data on a single device made the intrusion cheaper than it should have been.
Get breakdowns like this every day
The top Hacker News stories, unpacked — by email, Telegram, or RSS.
Study says giant trees have 'no trouble' pumping water up 70 metres. A commenter notes they aren't pumping at all
The world's tallest tropical trees move water to their crowns without paying a drought penalty, a new Science paper reports — overturning the assumption that extreme height starves the top branches. The thread admires the finding and picks at the verb: nothing is being pumped.