Stelios Kouloglou, a former Greek member of the European Parliament, was hacked at least three times with NSO Group’s Pegasus spyware during 2022 and 2023, a Citizen Lab report confirmed in July 2026 [1, 2, 3]. Kouloglou served as a substitute member of the European Parliament’s PEGA Committee, established in March 2022 to investigate abuses of Pegasus and other spyware in EU member states, when he was targeted [1, 4, 2].

The infections coincided with critical periods of committee activity, including an initial breach in October 2022 and further infections in March 2023 during the committee’s final report preparation [1, 5, 2, 3]. Citizen Lab’s forensic analysis found that zero-click exploits were used to compromise Kouloglou’s iPhone [5, 6, 3]. These spyware infiltrations risked exposing highly confidential documents, breaching the European Parliament’s confidentiality and privilege frameworks [1, 4, 2, 3].

Citizen Lab researchers could not link the attacks to any specific government but noted the campaign aligned with Pegasus targeting of Russian and Belarusian exiled journalists in Europe [1, 4, 5, 2, 3]. Kouloglou, known as an investigative journalist and MEP affiliated with Syriza before sitting as independent and with the New Left, said the hacking was "reckless" and "inconceivable" given his role investigating spyware abuses. He added, "When you realise your private life is scrutinised by very bad people, you become angry," and called the surveillance of him while on the Pegasus Committee "something really too reckless" [1, 5, 6, 3].

John Scott-Railton of Citizen Lab said, "It’s open spyware season on Europe’s lawmakers. The European Parliament, national parliaments, nobody is prepared" [6]. The number of people illegally targeted in the Greek Watergate spyware scandal exceeded 80 [1].

NSO Group declined to comment following Citizen Lab’s report publication [1, 5]. Kouloglou’s term as MEP ended in July 2024 [4]. In May 2026, Kouloglou contacted Citizen Lab for a forensic analysis that confirmed the infections, leading to the public disclosure in July 2026 [4, 2, 3].