As reported by Security Affairs, citing a Citizen Lab investigation, former European Parliament Member Stelios Kouloglou was repeatedly compromised with NSO Group's Pegasus spyware while actively serving on a committee probing that same technology's misuse. The recursive nature of this attack deserves far more attention than it has received.
Why This Is a Watershed Moment
This is not simply another Pegasus headline. The targeting of a sitting EU legislator — one with direct oversight authority over surveillance technology policy — represents a fundamental assault on the separation between state power and democratic accountability. When the subject of a parliamentary investigation becomes a surveillance target because of that investigation, it signals that operators of commercial spyware are willing to neutralize political opposition at the highest levels.
The implications extend well beyond one individual. If legislators conducting oversight can be compromised, the integrity of findings, witnesses, internal communications, and policy deliberations are all potentially poisoned. This isn't espionage at the margins — it's a direct attack on the institutional machinery of democratic governance.
The Commercial Spyware Accountability Gap
NSO Group has repeatedly claimed that Pegasus is sold exclusively to vetted government clients for lawful interception of criminals and terrorists. Yet the documented target list — which now includes human rights lawyers, journalists, dissidents, and sitting parliamentarians — tells a profoundly different story. The question defenders and policymakers must grapple with is structural: Who controls the controllers?
Commercial spyware vendors occupy a legally ambiguous space where they can claim distance from end-user conduct while profiting from capabilities that have no plausible legitimate use against elected oversight officials.
EU regulators passed the Artificial Intelligence Act and GDPR with significant global influence, but commercial surveillance technology remains inadequately governed even within European borders. This incident should accelerate calls for binding procurement restrictions and mandatory transparency reporting on member state spyware licenses.
Who Is at Risk
High-value targets should assume that standard enterprise mobile device management provides no meaningful protection against Pegasus-class zero-click exploits. The attack surface is the device itself, not user behavior.
What Defenders and Institutions Should Understand
Pegasus is distinguished by its use of zero-click exploit chains — no user interaction is required for compromise. Historical variants have exploited vulnerabilities in iMessage, WhatsApp, and other messaging stacks. Even fully patched devices have been compromised, as NSO Group invests heavily in maintaining a pipeline of undisclosed vulnerabilities. This makes behavioral detection and network-level telemetry the most viable detection approaches, since endpoint prevention is frequently bypassed.
Citizen Lab's methodology — comparing network traffic patterns and device forensics against known Pegasus infrastructure indicators — remains the gold standard for forensic attribution in these cases. Organizations supporting at-risk individuals should familiarize themselves with Citizen Lab's published IOCs and detection tooling, including the open-source MVT (Mobile Verification Toolkit).
Shield53 Recommendations
For High-Risk Individuals and Their Organizations
- Enroll in Apple Lockdown Mode on iOS devices — this meaningfully reduces the attack surface for zero-click exploits by disabling certain message processing features, though it is not a guarantee of protection.
- Conduct regular device forensics using MVT (github.com/mvt-project/mvt) against both iOS backups and Android devices, especially before and after sensitive political engagements.
- Compartmentalize sensitive communications to dedicated, regularly rotated devices that are not used for general browsing or messaging app installation.
- Audit your network traffic for known Pegasus C2 infrastructure using Citizen Lab's published domain and IP indicators.
- Brief legislative staff and aides — targets are often reached through the devices of trusted associates rather than the principal directly.
For Policymakers
- Mandate that EU member states disclose commercial spyware procurement to an independent oversight body.
- Extend existing export control frameworks to cover spyware capabilities equivalent to Pegasus, regardless of vendor nationality.
- Fund independent technical capacity — like Citizen Lab's — within EU institutions to conduct ongoing surveillance threat assessments.
The targeting of Kouloglou is a data point in a disturbing trend, but it is also an opportunity. Democratic institutions now have a concrete, documented case to justify urgent, binding action on commercial spyware regulation. The question is whether they will act before the next investigator becomes the next victim.
