Citizen Lab Finds Spyware on Former MEP Stelios Kouloglou’s Device

Citizen Lab has confirmed that the mobile device of Stelios Kouloglou, a former member of the European Parliament, was infected with Pegasus spyware. The breach occurred while Kouloglou was actively investigating the misuse of surveillance software within EU member states, highlighting a persistent gap in digital protections for European lawmakers.

This intrusion is not an isolated technical failure but a targeted political strike. When the tools designed for counter-terrorism are turned against those overseeing the state, the democratic process itself is compromised. The problem is systemic: lawmakers lack the sovereign technical infrastructure to protect their communications from the very governments they regulate.

How did the Pegasus infection occur?

According to the technical analysis provided by Citizen Lab, the infection typically involves “zero-click” exploits. These attacks require no action from the user—no malicious links to click and no files to download. The spyware enters the device through vulnerabilities in common apps like iMessage or WhatsApp, granting the operator total access to encrypted messages, microphones, and cameras.

Kouloglou’s role as a critic of surveillance abuses made him a high-value target. The timing of the breach coincides with his efforts to hold EU administrations accountable for the deployment of NSO Group’s technology. By compromising his device, the attackers gained a window into his sources, his strategy, and his unpublished findings.

The vulnerability of high-ranking officials suggests that standard commercial security is insufficient. Public figures are now seeking specialized European Parliament security protocols and private [Cybersecurity Consulting Firms] to perform forensic audits of their hardware.

Why does this breach matter for EU law?

The targeting of a former MEP exposes the fragility of the General Data Protection Regulation (GDPR) when faced with state-sponsored espionage. While the GDPR protects citizens from corporate data misuse, it offers little shield against “national security” exceptions used by intelligence agencies to justify the use of Pegasus.

“The use of Pegasus against elected representatives is a direct assault on the mandate of the European Parliament and the principle of parliamentary immunity.”

This case creates a dangerous precedent. If a former lawmaker can be breached with impunity, current officials may begin to self-censor. This “chilling effect” erodes the quality of oversight and allows the proliferation of spyware across the continent to continue unchecked.

As the legal battle over surveillance rights intensifies, the demand for [International Human Rights Law Firms] has surged. These professionals are tasked with navigating the complex intersection of national security laws and fundamental privacy rights.

The broader pattern of surveillance in Europe

The Kouloglou case is part of a wider trend documented across the EU. Similar patterns of Pegasus deployment have been identified in Poland, Hungary, and Greece. In these jurisdictions, the software has been used not to track criminals, but to monitor journalists, opposition politicians, and activists.

The contrast between official government denials and Citizen Lab’s forensic evidence is stark. While governments often claim the software is used strictly for “fighting terrorism,” the evidence consistently points toward political espionage.

The technical sophistication of these attacks means that simple software updates are no longer enough. Organizations are now implementing “air-gapped” communication systems and rotating hardware frequently to minimize the window of exposure.

What happens to the investigation now?

The breach of Kouloglou’s device potentially compromises every source he interacted with during his investigation into Pegasus. This puts whistleblowers and intelligence sources at immediate risk of exposure and retaliation.

The European Parliament’s PEGA Committee was established to investigate these abuses, but the infection of its own members proves that the investigators are also the targets. The committee faces the uphill task of recommending legislation that can actually constrain the ability of member states to purchase and deploy such invasive tools.

For those currently targeted or fearing surveillance, the immediate priority is digital hygiene and the procurement of forensic verification. Securing vetted [Digital Forensic Specialists] is the only way to determine the extent of a breach and purge the system of persistent implants.

The infection of Stelios Kouloglou is a reminder that in the era of zero-click warfare, privacy is no longer a default setting—it is a luxury that requires constant, professional defense. As state-sponsored spyware becomes more accessible, the line between legitimate security and digital authoritarianism continues to blur, leaving the democratic guardrails of Europe in a precarious position.