Pegasus Spyware Strikes Again: A European Politician's Phone Hacked

Security researchers have confirmed that a European politician had his phone hacked with the notorious Pegasus spyware while serving on an investigatory committee probing abuses of the surveillance tool.

The researchers at the University of Toronto's digital rights unit, The Citizen Lab, say the confirmed phone hacking of Greek journalist and former politician Stelios Kouloglou during 2022 and 2023 marks the first time that a member of the European Parliament's PEGA committee has been publicly identified as a victim of spyware.

A Reckless Compromise

Kouloglou described the deliberate compromise of his phone as "reckless" in a phone call with TechCrunch. One serving European lawmaker described the hacking of Kouloglou's phone as a "direct attack on the rule of law," and called on the European Commission to take concrete action by imposing strict limits on the use of spyware across the 27 member-state bloc.

"You realize that all of your personal data [was taken] — not all the professional exchanges or messages with ministers — but also the very private things, like the happy moments and the sad moments," Kouloglou told TechCrunch.

The Hacking Incidents

Citizen Lab's researchers did not attribute the phone hacking to a specific country, but said that the government customer used the same Pegasus-loaded email address that was used in a previous campaign that hacked into the phones of journalists across Europe. The customer's identity is not known, but the reuse of the same attacking email address implies that the customer had NSO Group's authorization to use its Pegasus spyware to snoop on phones across multiple countries in Europe.

• The first hacking incident occurred in October 2022, when Kouloglou's phone was compromised using an exploit that targeted a security vulnerability in Apple's iPhone software.
• The second hacking incident occurred in March 2023, when Kouloglou's phone was hacked again by the same Pegasus operator while he traveled from Athens to Brussels.
• The hacking incidents coincided with intense discussions over email and text message ahead of the delivery of a first draft describing spyware abuses focusing on Cyprus, Greece, Hungary, Poland, and Spain.

Implications and Next Steps

The hacking of Kouloglou's phone has significant implications for the use of spyware by governments and the need for stricter regulations. Kouloglou plans to sue NSO Group, the Israeli-headquartered spyware maker, and is going public with his story "for democracy, human rights, and the fight against corruption."

• The European Commission has been called upon to take concrete action by imposing strict limits on the use of spyware across the 27 member-state bloc.
• NSO Group remains largely banned from use in the United States following a Biden-era executive order that outlawed the government's use of spyware that could violate people's human rights.
• The hacking incidents have reignited controversy over governments using spyware to collect information about their critics, and highlight the need for greater transparency and accountability in the use of surveillance tools.