A new report has added another troubling chapter to Europe's long-running spyware controversy. Stelios Kouloglou, a journalist and former member of the European Parliament, was reportedly targeted multiple times with Pegasus spyware while he was involved in an EU investigation examining the very companies behind such surveillance technology.
The findings, published by Citizen Lab at the University of Toronto, indicate that Kouloglou's iPhone was compromised on at least two occasions between 2022 and 2023. At the time, he was serving on the European Parliament's PEGA Committee, which was created to investigate the use, sale and oversight of Pegasus and similar commercial spyware tools.
The case has drawn attention not only because of who was targeted, but because of the apparent irony involved. A lawmaker helping investigate alleged spyware abuse was reportedly infected by the same type of technology under scrutiny.
What Is Pegasus Spyware?
Pegasus is a highly sophisticated mobile surveillance tool developed by Israel-based NSO Group. The company has long maintained that the technology is sold only to governments and law-enforcement agencies for use against terrorists, organised crime groups and other serious threats.
Once deployed, however, spyware of this kind can potentially give an operator deep access to a victim's phone. This may include private messages, calls, stored files, contacts and other sensitive personal information.
Over the years, researchers and media organisations have documented numerous cases in which Pegasus was allegedly used against journalists, activists, lawyers, political figures and government critics. These reports have raised serious concerns about whether tools designed for legitimate security investigations are being used far beyond their intended purpose.
A Zero-Click Attack Raises the Stakes
Citizen Lab found that at least one of the attacks against Kouloglou involved a so-called zero-click exploit.
This means the phone may have been compromised without the user needing to open a suspicious link, download a file or interact with a message. In other words, the attack could happen silently in the background.
Zero-click attacks are among the most advanced forms of mobile intrusion because they leave victims with very little opportunity to recognise or avoid the threat. Traditional cybersecurity advice, such as avoiding unknown links or suspicious attachments, offers limited protection when the device itself can be targeted without any user action.
For public figures, journalists and political representatives, this creates a particularly serious privacy and security concern.
Why Kouloglou's Case Matters
Kouloglou was not simply another political figure who may have been targeted. He was part of the PEGA Committee, a European Parliament body established to examine the trade and use of Pegasus and other surveillance systems.
The committee eventually concluded that commercial spyware posed a significant risk to democracy, civil liberties and fundamental rights. Its recommendations included stronger rules around the sale, deployment and oversight of such technology across the European Union.
According to Kouloglou, his phone contained highly sensitive material, including communications with Greece's former prime minister Alexis Tsipras, private health-related information and confidential contacts from his journalism work.
Citizen Lab's report did not identify the party responsible for targeting him. However, the organisation reportedly found indicators suggesting that the same operator may also have targeted independent Russian- and Belarusian-speaking journalists and opposition activists based in Europe.
That possibility makes the case even more concerning, as it may point to a broader pattern rather than an isolated incident.
Europe's Spyware Problem Is Far From Resolved
This is not the first time members of the European Parliament have reportedly been linked to Pegasus targeting. Previous cases involved Catalan lawmakers, as well as a French representative.
However, the targeting of a member connected directly to the PEGA Committee carries particular weight. It raises difficult questions about whether the committee's warnings were taken seriously enough and whether EU institutions have acted quickly enough to prevent misuse.
Citizen Lab researcher John Scott-Railton described the situation as a powerful example of Europe's ongoing spyware crisis. From his perspective, the case demonstrates how easily surveillance technology can be turned against people responsible for questioning or investigating it.
Former Dutch MEP Sophie in 't Veld, who was involved in the PEGA Committee's work, has also argued that spyware abuse has continued with little accountability or meaningful consequence.
The Challenge of Regulating Powerful Surveillance Tools
The European Commission has stated that illegal attempts to access the data of citizens, journalists and political opponents are unacceptable. It has also said that spyware misuse is being addressed through different areas of EU law and policy.
Still, the challenge is complicated.
Spyware often exists in a legal grey area because governments can argue that it is necessary for national security, crime prevention or counterterrorism work. At the same time, the secrecy surrounding these tools makes independent oversight difficult.
Without strong safeguards, transparent accountability and meaningful consequences for misuse, powerful surveillance tools can become a threat to the people they are supposed to protect.
Final Thoughts
The alleged targeting of Stelios Kouloglou is a stark reminder that commercial spyware is not only a cybersecurity issue. It is also a question of democracy, privacy, press freedom and political accountability.
Technology like Pegasus may have legitimate law-enforcement applications in narrowly defined situations. But when it is reportedly used against journalists, activists or political figures, the consequences can extend far beyond a single compromised phone.
As digital surveillance capabilities become more advanced, the demand for independent oversight and stronger protections will only become more urgent.
Comments