Spyware Pegasus infected phone of EU lawmaker investigating surveillance in European Union

The Citizen Lab organization confirmed in July 2026 that the phone of former Greek MEP Stelios Kouglou, who was himself investigating the use of spyware in the European Union, was infected with the Pegasus program in October 2025; after publishing the evidence, human rights organizations demanded urgent action from the European Commission.

Exactly Who Was Hacked

Stelios Kouglou is a former member of the European Parliament from Greece. In the past, he was involved in investigations by European authorities into the use of commercial spyware against politicians, journalists and activists within the EU. The fact that the victim of surveillance was a person who had previously studied such cases became particularly alarming for human rights advocates.

• The breach was confirmed by Citizen Lab — a Canadian digital forensics laboratory
• The victim — Stelios Kouglou, a former MEP from Greece
• Infection occurred with Pegasus in October 2025
• Human rights organizations issued a joint statement demanding action from the European Commission

Why the European Commission Came Under Pressure

Civil organizations called on the EU to respond to spyware abuse with "accountability, not impunity." Pegasus was developed by Israeli company NSO Group and can infect smartphones without any action from the victim (a so-called zero-click attack), after which it gains access to messages, calls, microphone and camera of the device. In recent years, the program has featured in surveillance scandals involving journalists, human rights defenders and politicians in several EU countries, including Greece itself, Poland and Hungary.

How the EU Has Already Responded to Pegasus Scandals

Pegasus scandals in the European Union have been ongoing for years. In 2022, the European Parliament created a special committee to investigate the use of spyware (PEGA), which in 2023 published a report with recommendations to limit the use of such technologies against politicians and journalists within the EU. Back in November 2021, the United States included Pegasus' developer, NSO Group, on the Commerce Department's sanctions list, restricting its access to American technology. Despite these measures, cases of politicians and public figures in Europe being infected with spyware continue to emerge regularly.

What This Means

The Kouglou case shows that years after public investigations, commercial spyware continues to be used against people who, by their position, should be protected from surveillance — and the European Union still lacks the real leverage to enforce accountability.