First Confirmed: Pegasus Reuses Attack Email to Hack EU Spyware Investigator

For cybersecurity analysts, the Kouloglou case is a textbook example of spyware tradecraft gone wrong. The identical attacker email infrastructure linking two separate campaigns suggests a high degree of operator carelessness—or confidence—that could be exploited for attribution. The attack underscores the persistent threat posed by commercial spyware like Pegasus, which continues to bypass modern endpoint protections.

The confirmation by the University of Toronto’s Citizen Lab that Greek journalist and former politician Stelios Kouloglou was targeted with NSO Group’s Pegasus spyware while serving on the European Parliament’s PEGA committee marks a watershed moment in the ongoing saga of commercial spyware abuse. Kouloglou, a member of the very committee tasked with investigating illicit surveillance across the EU’s 27 member states, had his phone infected during 2022 and 2023—coinciding with the committee’s active inquiry into the misuse of Pegasus and equivalent tools. The deliberate targeting of an oversight body investigator with the same spyware under probe shatters the pretense that such tools are used only against serious criminals, and it elevates the scandal to a direct assault on parliamentary sovereignty and the rule of law.

“

The attack underscores the persistent threat posed by commercial spyware like Pegasus, which continues to bypass modern endpoint protections.

The forensic link to a reused Pegasus-loaded email address—previously deployed in a campaign that hacked journalists across Europe—underscores the brazenness of the unidentified government customer. While Citizen Lab stopped short of attributing the attack to a specific country, the reuse of attack infrastructure implies that the customer retained NSO Group’s authorization and operational support, raising acute questions about the Israeli company’s vetting and enforcement of its own human rights policies. For years, NSO has claimed it cooperates with investigations and terminates contracts with abusive clients, yet the persistence of the same email vector suggests either complicity or a profound failure of oversight. European lawmakers have seized on the incident, with one describing it as a “direct attack on the rule of law” and demanding the European Commission impose binding limits on spyware across the bloc.

The timing of the hack—during the PEGA committee’s evidence-gathering phase—raises grave concerns about the integrity of its forthcoming report, which is widely expected to call for strict EU-wide regulation. If the attacker gained access to Kouloglou’s communications, they could have monitored internal deliberations, identified witnesses, and gained insight into the committee’s strategies. This constitutes not merely a privacy violation but a potential interference in a sovereign parliamentary process. The legal implications are profound: it may trigger Article 7 proceedings against the member state responsible, expose the spyware vendor to sanctions under the EU’s dual-use export control regime, and open the door for lawsuits before the European Court of Human Rights. For regulators, the incident serves as a catalyst to accelerate the long-stalled European initiative to ban or heavily restrict government-use spyware.