The investigation stops short of naming any government that may have used Pegasus against Kouloglou, noting in particular that it found no indication of Greek government involvement. But Citizen Lab says it found overlaps between the attacks on Kouloglou’s phone and the use of Pegasus against seven Russian- and Belarusian-speaking journalists and activists between August 2020 and January 2023.

“They didn’t just target an MEP, they spied on the spyware abuse investigation itself. That shows the absurdity of the situation,” Hannah Neumann, a Green MEP who served on the spyware committee, tells WIRED.

A spokesperson for the European Parliament did not directly comment on the findings when asked about it by WIRED, but says it has a “spyware detection system” that is available to all MEPs and has recently taken steps to expand its protections.

Kouloglou’s phone was first infected while he was in the hospital on October 21, 2022, according to Citizen Lab findings. While recovering from elective surgery, he was visited by Greek investigative journalist Thanasis Koukakis, who had previously been hacked with Predator spyware. The following week, the PEGA Committee held several hearings on the impact of spyware and how it could interfere with human rights. Committee members, including Kouloglou, visited Cyprus and Greece as part of their investigations.

On March 6 and 7, 2023, according to the findings, Kouloglou’s phone was infected again with Pegasus spyware. Neumann, who was also part of the investigation, says that at the time Kouloglou’s phone was first compromised, the committee was targeting “key audiences,” including questioning companies operating in the spyware industry.

At the time of the 2023 incident, Neumann says, the group was finalizing and conducting negotiations on its conclusions. “Looking at the dates, it’s pretty obvious that someone wasn’t just randomly spying on him, but really focused on the committee’s work,” Neumann says.

“I got angry because you realize that your private life, including messages not only with politicians and friends, but also your personal life with family, children, wives, etc., has been monitored by someone,” Kouloglou says. “It’s not just about privacy, but also about justice, democracy and the fight against corruption.”

Citizen Lab discovered, as part of its forensic analysis, that Kouloglou’s phone received three notifications from Apple, in March and August 2023 and April 2024, alerting him that he was likely being attacked with spyware. These notifications are not issued in real time and Kouloglou says he does not remember seeing them.

Kouloglou and other MEPs told WIRED they are concerned that other committee members may have also been targeted and that the group’s recommendations, including the creation of an EU-based technology lab focused on forensic device analysis and a task force on election spyware, have not been adopted years after the committee completed its report.

“Europe has a mountain of spyware abuse and nothing has happened; it is a shame for European institutions,” says Scott-Railton of Citizen Lab. “It leaves Europeans unprotected even as AI promises to accelerate the threat of mercenary spyware by lowering costs and barriers to entry.”

It also notes that some countries, including the United States, have made progress in combating the use of spyware through sanctions, visa bans, executive orders and other deterrents.

“There is no lack of awareness about the problems that come with mercenary spyware,” says Neumann. “That’s what the Pegasus Committee wrote the entire report about. There’s no shortage of recommendations on how to fix it. It’s just a question of, could you do it now?”