As reported by The Hacker News, citing new research from the Citizen Lab, former Member of the European Parliament Stelios Kouloglou — who served on the body tasked with scrutinizing the misuse of commercial spyware across EU member states — was himself repeatedly compromised with Pegasus spyware during his tenure. This is not simply another surveillance story. It is a direct assault on the institutional capacity of democratic governments to hold the surveillance industry accountable.
Why This Matters Far Beyond One Device
The targeting of a legislator whose explicit mandate was to investigate tools like Pegasus represents a qualitative escalation in the brazenness of commercial spyware operators — or, more precisely, whoever their clients are in this case. When investigators become targets, the message sent to the broader oversight community is deliberate and unmistakable: no one conducting this work is safe.
This incident fits a troubling pattern Shield53 analysts have been tracking for several years. Pegasus and similar Tier-1 commercial spyware tools are increasingly being deployed not just against journalists, dissidents, and activists in authoritarian contexts, but against individuals operating within the institutional frameworks of liberal democracies. The European Parliament's PEGA Committee — convened specifically to examine Pegasus abuse — becoming a target of that same abuse is almost poetically cynical.
When the investigators become the investigated, we are witnessing a fundamental breakdown in the deterrence model that underpins spyware regulation. The oversight mechanism itself has been subverted.
What This Tells Us About Threat Actor Calculus
The decision to deploy Pegasus against a sitting MEP was not made without risk calculation. NSO Group's product has been widely publicized, forensically documented, and is now subject to export controls and sanctions in multiple jurisdictions. Whoever commissioned this operation clearly judged that the intelligence value outweighed the significant risk of exposure — or believed exposure would have minimal consequences. That judgment, if it proves correct, is deeply dangerous for the future of accountability in this space.
From a technical standpoint, this also reinforces what Citizen Lab and others have demonstrated repeatedly: Pegasus operators leverage zero-click exploit chains against fully updated devices, meaning even security-conscious targets using current iOS or Android builds cannot rely on patch hygiene alone as a defense. The attack surface here is the operating system itself — specifically the processing pipelines for messaging, email, and media content.
Who Is Most at Risk Right Now
The Regulatory Dimension
This incident arrives at a moment when the EU is actively debating the scope of its spyware regulations and whether existing frameworks — including the proposed European Media Freedom Act and export control regimes — are sufficient. The irony that the committee examining those very questions was infiltrated should generate political urgency. However, Shield53 analysts caution that legislative responses alone will not solve a problem that is fundamentally operational and technical in nature. Rules without enforcement, and enforcement without detection capability, produce only the appearance of accountability.
Shield53 Recommendations
For High-Risk Individuals and Their Organizations
- Enroll in Apple Lockdown Mode or Android equivalent hardening immediately if you fall into any of the at-risk categories above. Lockdown Mode has been demonstrated to block several Pegasus exploit chains by significantly reducing attack surface.
- Treat your mobile device as a hostile environment for sensitive communications. Use dedicated, air-gapped or network-isolated devices for the most sensitive discussions where feasible.
- Request periodic forensic audits of mobile devices through trusted third parties such as Citizen Lab's Access Now Digital Security Helpline, Amnesty Tech, or qualified private forensic firms. Pegasus infections leave detectable artifacts on both iOS and Android.
- Implement network-level telemetry monitoring where possible. Pegasus command-and-control infrastructure, while regularly rotated, produces detectable DNS and TLS patterns that endpoint detection alone will miss.
- Compartmentalize communications — assume any device used for general internet browsing, email, or messaging apps can be compromised. Use separate hardware for sensitive committee or investigative work.
For Security Teams Supporting Legislative or NGO Clients
- Implement Mobile Threat Defense (MTD) solutions capable of detecting anomalous process behavior indicative of Pegasus-like implants.
- Establish a baseline forensic program with scheduled device reviews — not just incident-response-triggered ones.
- Brief principals on the limits of conventional endpoint security. Pegasus operates below the visibility of most commercial MDM and EDR tooling.
The Kouloglou case is a stark reminder that the commercial spyware industry has created capabilities that are now routinely turned against the very democratic institutions designed to govern them. Until accountability mechanisms develop teeth — both technically and legally — oversight bodies must assume they are targets and protect themselves accordingly.
