Zero-Click Pegasus Exploit PWNYOURHOME Hit MEP's iPhone Twice in 6 Months

The phone of an MEP sitting on the EU’s spyware inquiry committee was infected via a zero-click exploit—without a single tap—using the PWNYOURHOME vulnerability. This isn’t a proof-of-concept; it’s a real-world, repeated hit with forensic traces that paint a stark picture of the surveillance capabilities deployed against democratic institutions.

In July 2026, the University of Toronto’s Citizen Lab uncovered a stunning security breach at the heart of European democratic institutions: Stelios Kouloglou, a Greek Member of the European Parliament and substitute member of the committee investigating spyware abuse, was himself infected with the Pegasus spyware while the committee was active. The forensic analysis of Kouloglou’s iPhone revealed high-confidence evidence of two separate infection periods—on or around October 21, 2022, and again on March 6–7, 2023—both occurring while he sat on the European Parliament’s Committee of Inquiry to investigate the use of Pegasus and equivalent surveillance spyware (PEGA Committee). Kouloglou, a prominent investigative journalist and former Syriza party MEP, had contacted Citizen Lab in May 2026, well after his term ended, seeking answers. The discovery exposes not only the targeting of an elected official but the potential compromise of an official EU investigation into spyware misuse, raising urgent security, legal, and political questions.

“

Such zero-click capabilities are characteristic of state-grade spyware, and while the client behind this attack is not named in the Citizen Lab report, the use of Pegasus—developed by Israel’s NSO Group—points to a government customer.

The political context is damning. The PEGA Committee was established on March 10, 2022, in the wake of the 2021 Pegasus Project revelations that multiple European governments had used spyware against journalists, activists, and political opponents. Kouloglou was appointed a substitute member on March 24, 2022, meaning he was actively probing the unlawful use of surveillance tools when his own device was broken into. The irony is sharp: a spyware investigator became a spyware victim. The committee, led by Dutch MEP Sophie in ‘t Veld, was tasked with assessing the contravention of EU law and making recommendations to safeguard fundamental rights. Its work culminated in a final report in mid-2023. The fact that a member’s communications were potentially accessible in real time to an unknown actor during this process could undermine the integrity of the inquiry and raises fears that other committee members or staff may also have been targeted.

Technically, the attack used the PWNYOURHOME zero-click exploit, a highly sophisticated tool that requires no user interaction—typically delivered via a malicious iMessage or network packet. On October 21, 2022, at 10:16 UTC, the device performed a lookup for the suspicious HomeKit email address rauharepo888@gmail.com; two minutes later, a Pegasus process was observed using mobile data, consistent with data exfiltration. The second infection wave on March 6–7, 2023, suggests that the attacker maintained persistent interest, possibly to re-infect after a patch or to update their access. Such zero-click capabilities are characteristic of state-grade spyware, and while the client behind this attack is not named in the Citizen Lab report, the use of Pegasus—developed by Israel’s NSO Group—points to a government customer. The incident fits a grim pattern: Citizen Lab and other watchdogs have documented numerous cases of Pegasus being used against journalists, lawyers, activists, and politicians across Europe and beyond.