• Former Member of the European Parliament, Stelios Kouloglou, was repeatedly hacked with NSO Group’s Pegasus spyware while on the committee investigating Pegasus spyware abuses.
• Kouloglou was infected during key periods of PEGA committee activity, and the spyware would have likely captured non-public information about committee activities, possibly breaching EU parliamentary confidentiality and privilege frameworks.
• We are not attributing these infections to a particular government at this time, and found no indications that the Greek Government is responsible. Instead, we note an overlap between the first infection and a previously identified Pegasus campaign targeting Russian and Belarusian-speaking exiled journalists and activists in Europe, suggesting a Pegasus customer with authorization to spy in multiple European countries is responsible.

…

Whichever entity is responsible for the hacking, the infection could have exposed strictly confidential exchanges among PEGA Committee members and their staff, and other sensitive and confidential parliamentary proceedings, including to parties under investigation by the Committee itself.

The finding that a PEGA Committee member was targeted with Pegasus spyware during the Committee’s work highlights the serious threat that mercenary spyware poses to the integrity of democratic processes.

As outlined above, this case is not the first that a Member of the European Parliament has had their devices either targeted or hacked with mercenary spyware, which illustrates the corrosive nature of unregulated mercenary hacking.

…

Web Archive link