--- title: Espionage Against the European Parliament: Member of... description: The Citizen Lab confirmed that former MEP Stelios Kouloglou, a substitute member of the European Parliament's PEGA Committee investigating Pegasus spyware... canonical: https://daily.dev/posts/espionage-against-the-european-parliament-member-of-committee-investigating-spyware-hacked-with-peg-vju1ktmcp twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Espionage Against the European Parliament: Member of Committee Investigating Spyware Hacked with Pegasus | daily.dev og:description: The Citizen Lab confirmed that former MEP Stelios Kouloglou, a substitute member of the European Parliament's PEGA Committee investigating Pegasus spyware... og:url: https://daily.dev/posts/espionage-against-the-european-parliament-member-of-committee-investigating-spyware-hacked-with-peg-vju1ktmcp og:image: https://api.daily.dev/og/posts/Vju1kTMcP.png og:image:alt: Espionage Against the European Parliament: Member of Committee Investigating Spyware Hacked with Pegasus og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Espionage Against the European Parliament: Member of Committee Investigating Spyware Hacked with Pegasus **[Lobsters](https://daily.dev/sources/lobsters)** · 17 min read · 0 upvotes · 0 comments ## Summary The Citizen Lab confirmed that former MEP Stelios Kouloglou, a substitute member of the European Parliament's PEGA Committee investigating Pegasus spyware abuses, was himself hacked with Pegasus on at least three occasions: October 21, 2022, and March 6–7, 2023. Forensic analysis of his iPhone identified the PWNYOURHOME zero-click exploit targeting HomeKit. The infections coincided with critical PEGA Committee activities including draft report preparation, country visits, and intense deliberations. Attribution points toward a Pegasus operator also responsible for targeting Russian and Belarusian-speaking exiled journalists in Europe, with no evidence of Greek government involvement. The Citizen Lab recommends immediate forensic screening of all PEGA Committee members and staff, annual cyber-threat reporting for the European Parliament, and improved UX for Apple and Google threat notifications. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is the PWNYOURHOME exploit and which iOS versions does it affect? PWNYOURHOME is a zero-click Pegasus exploit that first sends a specially crafted NSKeyedArchive payload to HomeKit, followed by malicious content targeting MessagesBlastDoorService. Apple mitigated the HomeKit stage in iOS 16.3.1 and likely fixed the MessagesBlastDoorService stage in iOS 16.1. The exploit was used to infect a device running iOS 15.5 (19F77). _Developers and security teams tracking iOS exploit mitigations find Citizen Lab disclosures like this on daily.dev._ ### Has any member of the European Parliament's PEGA Committee been confirmed infected with Pegasus spyware? Yes. Former MEP Stelios Kouloglou, a substitute member of the PEGA Committee, was confirmed infected with Pegasus on October 21, 2022, and again on March 6–7, 2023 — both during critical periods of the committee's work. This is the first public identification of a sitting PEGA Committee member as a Pegasus victim. The infections were identified through forensic analysis of his iPhone by the Citizen Lab. _Those tracking mercenary spyware incidents against democratic institutions follow cases like this on daily.dev._ ## Community take How the wider developer community reacted, aggregated from 2 discussions and 264 comments across hackernews, lobsters (as of 2026-08-07). **TL;DR:** Commenters are largely critical and alarmed — focused on the irony of a spyware investigator being hacked with the very tool he was probing, Apple's poor notification UX, and the broader reality that state-level espionage is pervasive and largely unpunished. There's also notable skepticism about whether the MEP genuinely missed Apple's warnings. **Sentiment:** 5% positive · 25% mixed · 70% skeptical **The case for** - iOS Lockdown Mode appears to be a practical mitigation that several commenters report using without major inconvenience. - Apple's threat notification system does exist and sends alerts via iMessage, email, and account.apple.com — providing at least some warning infrastructure. - Open-source forensic tools like MVT exist that allow individuals to check their own devices for Pegasus indicators. **The pushback** - The MEP reportedly missed or ignored multiple Apple threat notifications despite sitting on the committee specifically investigating Pegasus abuses. - Apple provides no persistent UI to review dismissed notifications, making it easy to miss critical security alerts. - Pegasus, once installed, likely has the capability to suppress or intercept the very notifications meant to warn the victim. - EU Parliament members apparently mix personal and work devices, creating unnecessary exposure of both sensitive government and personal data. - NSO Group employees face no meaningful legal consequences despite being implicated in criminal activity across dozens of countries. - Attribution remains uncertain, with plausible candidates including multiple European intelligence agencies operating outside their borders. **Hottest debate:** Whether the MEP genuinely missed Apple's spyware warnings or whether Pegasus suppressed them — or whether he was complicit in some way. **Open questions** - Which specific Pegasus operator or nation-state is responsible, given the overlap with campaigns targeting Russian and Belarusian exiled journalists? - How does Apple detect Pegasus infections to trigger threat notifications — known IOCs or heuristic analysis? - Why has the EU Parliament not mandated separate work and personal devices, or annual forensic screening, for members on sensitive committees? - Could Pegasus have actively intercepted or suppressed Apple's threat notifications on the compromised device? **Highlights** > That is kind of surprising given he is on the comittee investigating pegasus. I'd assume someone on the comittee would be paying much more attention to this than a normal person. I wonder what triggered him to suspect he was hacked then. Since presumably something triggered him to have his phone forensically investigated. > — [bawolff on hackernews · 4 comments](https://news.ycombinator.com/item?id=48780612) > Fairly sure that if anybody using a advanced piece of hacking software, they are also going to delete any messages that are related to detection of such hardware. PC viruses used to do that stuff going back so many years ago. Suppressing any notification under Windows, by disabling the AV software, its notifications, windows notifications related to it. So it will amaze me that this is not done by any modern espionage software. Especially as the notification methods are known. Given that his device is hacked, that means a lot of avenues are under control of the espionage software. Even mails etc ... So impersonating the end user, to confirm they read a warning, is extreme easy. I find it rather odd that people are so fixated on the idea if Kouloglou read it or not. > — [benjiro29 on hackernews · 1 comments](https://news.ycombinator.com/item?id=48780726) > Just for context, some european contries have been abusing spyware such as Pegasus so much Israeli firms have cut ties with them, one such example below with Italy. Others have pointed out Greece and Poland. It's quite laughable that a member of the EU parliament would be subject to the same kind of spying activities innocent journalists, activists and possibly normal people are, all of that by the member states of the union, directly contributing to the Israeli companies developing and spreading malware. https://www.bbc.com/news/articles/cvgmzdjw24yo > — [0x\_rs on hackernews · 1 comments](https://news.ycombinator.com/item?id=48780899) > I keep my phone in lockdown mode and haven’t noticed too many problems day-to-day. A few minor inconveniences (webGL doesn’t work, the magic automatic code from SMS keyboard integration is gone, etc.) but overall the phone is still a smart phone. > — [r3trohack3r on hackernews](https://news.ycombinator.com/item?id=48786091) > How is it that any NSO employee is still able to travel outside Israel without getting arrested? Seems like they're involved in criminal conspiracies in like half the countries in the world. > — [Hizonner on hackernews · 1 comments](https://news.ycombinator.com/item?id=48781195) **Source threads** - [hackernews](https://news.ycombinator.com/item?id=48779683) · 429 points · 264 comments - [lobsters](https://lobste.rs/s/xwsfs3/espionage_against_european_parliament) · 23 points · 0 comments ## Similar posts on daily.dev - [EU lawmaker who investigated spyware abuse was hacked with Pegasus](https://daily.dev/posts/eu-lawmaker-who-investigated-spyware-abuse-was-hacked-with-pegasus-xg3edgbjd) · The Next Web · 0 upvotes · 0 comments - [Politician who investigated spyware abuses had his phone hacked with Pegasus spyware](https://daily.dev/posts/politician-who-investigated-spyware-abuses-had-his-phone-hacked-with-pegasus-spyware-px3ivxj4r) · TechCrunch · 0 upvotes · 0 comments - [EU urged to act after Pegasus infects phone of spyware inquiry MEP](https://daily.dev/posts/eu-urged-to-act-after-pegasus-infects-phone-of-spyware-inquiry-mep-a1ttzpj74) · The Register · 0 upvotes · 0 comments - [EU urged to act after Pegasus hit its spyware inquiry](https://daily.dev/posts/eu-urged-to-act-after-pegasus-hit-its-spyware-inquiry-jiripovv2) · The Next Web · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security) [View this post on daily.dev](https://daily.dev/posts/espionage-against-the-european-parliament-member-of-committee-investigating-spyware-hacked-with-peg-vju1ktmcp) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Espionage Against the European Parliament: Member of Committee Investigating Spyware Hacked with Pegasus","url":"https://daily.dev/posts/espionage-against-the-european-parliament-member-of-committee-investigating-spyware-hacked-with-peg-vju1ktmcp","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/espionage-against-the-european-parliament-member-of-committee-investigating-spyware-hacked-with-peg-vju1ktmcp"},"datePublished":"2026-08-07T21:25:21.898Z","dateModified":"2026-08-07T21:26:08.777Z","description":"The Citizen Lab confirmed that former MEP Stelios Kouloglou, a substitute member of the European Parliament's PEGA Committee investigating Pegasus spyware...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/24f253badd73dde108801c19d2308b16?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/24f253badd73dde108801c19d2308b16?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Lobsters","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Lobsters","logo":"https://media.daily.dev/image/upload/s--tl8v_Fku--/f_auto,t_logo/v1698841318/logos/lobste.jpg","url":"https://daily.dev/sources/lobsters"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/espionage-against-the-european-parliament-member-of-committee-investigating-spyware-hacked-with-peg-vju1ktmcp","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security","timeRequired":"PT17M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Lobsters","item":"https://daily.dev/sources/lobsters"},{"@type":"ListItem","position":3,"name":"Espionage Against the European Parliament: Member of Committee Investigating Spyware Hacked with Pegasus"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/espionage-against-the-european-parliament-member-of-committee-investigating-spyware-hacked-with-peg-vju1ktmcp#faq","mainEntity":[{"@type":"Question","name":"What is the PWNYOURHOME exploit and which iOS versions does it affect?","acceptedAnswer":{"@type":"Answer","text":"PWNYOURHOME is a zero-click Pegasus exploit that first sends a specially crafted NSKeyedArchive payload to HomeKit, followed by malicious content targeting MessagesBlastDoorService. Apple mitigated the HomeKit stage in iOS 16.3.1 and likely fixed the MessagesBlastDoorService stage in iOS 16.1. The exploit was used to infect a device running iOS 15.5 (19F77). Developers and security teams tracking iOS exploit mitigations find Citizen Lab disclosures like this on daily.dev."}},{"@type":"Question","name":"Has any member of the European Parliament's PEGA Committee been confirmed infected with Pegasus spyware?","acceptedAnswer":{"@type":"Answer","text":"Yes. Former MEP Stelios Kouloglou, a substitute member of the PEGA Committee, was confirmed infected with Pegasus on October 21, 2022, and again on March 6–7, 2023 — both during critical periods of the committee's work. This is the first public identification of a sitting PEGA Committee member as a Pegasus victim. The infections were identified through forensic analysis of his iPhone by the Citizen Lab. Those tracking mercenary spyware incidents against democratic institutions follow cases like this on daily.dev."}}]} ```