Stelios Kouloglou served on the PEGA commission as a parliamentarian of the European Union. The commission was supposed to investigate spyware. According to an analysis by Citizen Lab, during his tenure he was spied on by the Pegasus spyware.
The whole story was spread by Citizen Labthe Toronto research unit that collaborated with Meta in 2025 to unravel the Paragon case. There are two protagonists. The first is the European parliamentarian Stelios Kouloglouelected on the lists of the left-wing Greek formation Syriza. The second is Pegasusa spyware produced by the Israeli company NSO Group. The name is known in the news: in July 2021 an investigation published in several newspapers revealed how Pegasus was used illegally by the governments that had the licenses, especially against journalists and political opponents. In May 2025, NSO Group lost a lawsuit against Meta for spying 1,400 WhatsApp users. The jury forced the software company to pay $167.25 million for the damage suffered, thus certifying the dynamics of the infiltration.
Now Citizen Lab has added a piece to this story. According to his research, Stelios Kouloglou was attacked by Pegasus during his tenure. The connection is not coincidental. Stelios Kouloglou was part of the PEGAthe European commission responsible for investigating the abuse of Pegasus and spyware in general in Europe. The effect is clear, whoever ordered the attack could access confidential documents and private conversations that took place between members of the commission.
The details of the case: Citizen Lab’s analysis
Stelios Kouloglou has been part of this commission since March 24, 2022 al July 18, 2023. The discovery of Pegasus’s tracks did not come immediately. It was Kouloglou himself who contacted Citizen Lab but only when his position on the PEGA commission had ended. The Greek MP contacted Citizen Lab in May of 2026. At this point the forensic analysis began on the device, an iPhone whose model, however, is not specified. The traces of the software date back to the time Kouloglou was on the commission. The attacks occurred on two occasions: the October 21, 2022 and between 6-7 March 2023.
The attack on WhatsApp that Meta continues to deny, Dal Checco: “We have evidence compatible with the violation”
The attacks are also reflected in the notifications received from Apple. It also happened in a similar case where Fanpage.it was the victim. Our journalist Ciro Pellegrino also received a notification from Apple when he suffered the attack. In the case of Kouloglou notifications arrived on three occasions: on March 2, 2023The August 29, 2023 and the April 10, 2024. So: Citizen Lab is certain of the infection. The problem is the instigator, as we read in the report: “We do not attribute these investigations to a specific client of NSO Group”.
However, researchers think that this attack is part of a campaign reported in May 2024 in which seven independent journalists and activists were also involved, all linked to theRussian and Belarusian opposition. These are the conclusions: “The infection of the device of an MEP and member of the PEGA Commission is a significant and worrying fact. Regardless of who is responsible for the cyber attack, the infection may have exposed strictly confidential exchanges between members of the PEGA Commission and their staff, as well as other sensitive and confidential information relating to parliamentary proceedings, including to individuals investigated by the Commission itself.”
