Argues the forensic overlap between Kouloglou's infection and a concurrent campaign against Russian/Belarusian exiles across multiple EU states forensically contradicts NSO's public defense. Either licensing is regional rather than national, or enforcement is theatrical — both undermine the sovereign-customer story NSO tells regulators and courts.
Frames the infection as espionage against the European Parliament itself: the attackers plausibly gained access to confidential committee deliberations, draft findings, and communications with witnesses — many of whom were spyware victims who came forward under an expectation of confidentiality. This turns Pegasus into a tool used against the very body investigating it.
Surfaced the Citizen Lab report to the HN community under the framing 'Espionage Against the European Parliament,' emphasizing the institutional-attack angle rather than the individual-victim angle. The 394-point score suggests strong resonance with the view that this is a governance story, not just a privacy story.
On July 3, Citizen Lab published the forensic report on former MEP Stelios Kouloglou's iPhone. The device was successfully infected with NSO Group's Pegasus spyware on or around October 21, 2022, and again on March 6 and 7, 2023. Kouloglou wasn't a random target: he sat on the European Parliament's PEGA committee — the special committee stood up in 2022 specifically to investigate Pegasus and other commercial spyware abuses across EU member states.
So the guy assigned to investigate Pegasus was, at the same time, being surveilled by Pegasus. The infections coincided with PEGA's active investigation window. Citizen Lab notes the attackers could have had access to confidential committee deliberations, draft findings, and Kouloglou's communications with witnesses — many of whom were themselves spyware victims who had come forward under an expectation of confidentiality.
The more interesting technical finding is buried further down. Citizen Lab writes that the October 2022 infection overlaps with a previously identified Pegasus campaign targeting Russian- and Belarusian-speaking exiled journalists and activists living in Europe. Same operator infrastructure. Same window. As the report puts it, the overlap suggests "a Pegasus customer with authorization to spy in multiple European countries is responsible."
NSO Group's entire public defense — the one it repeats to regulators, courts, and journalists — rests on a licensing model that goes roughly: we sell to sovereign governments, each customer is scoped to its own jurisdiction, and if a customer misuses the tool we investigate and revoke. That story has been fraying for years, but this finding puts a specific forensic dent in it.
If one customer's infrastructure was used against both an MEP sitting in Brussels and exiled dissidents scattered across multiple EU states, then either the licensing scope is regional rather than national, or the enforcement is theatrical. Neither reading is good for NSO, and neither is good for the EU governments that keep buying the product.
Community reactions on Hacker News zeroed in on the pattern. One commenter noted that around the time of Kouloglou's first infection, a batch of Greek politicians and journalists were also being hit — the still-unresolved Predator/Pegasus scandal that Greek reporting has tied to the office of the prime minister and the national intelligence service. Another pointed out that some European countries have burned through their reputational credit so thoroughly that Israeli firms have started cutting them off; Italy is the recent public example, with Greece and Poland in the same conversation. The idea that an EU member state's intelligence service — or a contractor operating on its behalf — would target a sitting MEP investigating that same intelligence service is, at this point, not shocking. It's the base rate.
One HN thread raised a smaller but sharper operational point: the report implies that both confidential personal medical information and confidential government documents were compromised via the same device. Does the European Parliament not have a policy of separating work and personal devices? The answer, as far as anyone can tell from public materials, is that MEPs get guidance, not enforcement. You can hand every legislator a hardened work phone, but if the culture treats "just use your iPhone" as an acceptable workflow, you've built a threat model that assumes the attacker plays fair. Pegasus, whose whole selling point is zero-click iMessage and Safari exploits, does not play fair.
The forensic overlap also matters for attribution work more broadly. The current public methodology for figuring out which NSO customer hit which target leans heavily on infrastructure clustering — grouping infections by shared C2 servers, install artifacts, and operator patterns. If a single cluster spans multiple countries' targets, the analytical shortcut of "this cluster = this country's operator" stops working. That shortcut has been how a lot of public accountability reporting got written. The next round of Citizen Lab and Amnesty Tech reports may need to hedge harder.
Most people reading this aren't MEPs, but the threat model shift matters if you're doing anything adjacent to journalism, dissident support, sanctions work, human rights orgs, or executive security for firms that touch politically sensitive markets. The old mental model — "figure out which government has motive to target me, then think about that government's capabilities" — assumed capability was gated by geography. Regional licensing collapses that assumption. If your adversary is a client of a commercial spyware vendor with EU-wide authorization, then "I'm not in Country X" stops being a defense.
Practical implications, roughly in order of what's cheap to change:
Separate personal and work devices, and mean it. Not "a work profile on the same phone" — a physically separate device, ideally one running a hardened build, with a call/messaging setup that never touches your personal SIM. This is table stakes for anyone whose committee work, source list, or client list is worth six-figures of exploit development to someone. The Kouloglou report is a live example of what happens when you don't.
Assume iMessage and Safari are attack surfaces, not features. Lockdown Mode on iOS exists specifically for this class of threat and is the single highest-leverage toggle Apple ships. It breaks link previews, some attachment types, and shared albums. That's the point. If the tradeoff sounds unacceptable, you are not in the threat model that needs Lockdown Mode.
For orgs: rotate devices on a schedule shorter than the vendor's exploit lifespan. Pegasus infections in this report re-occurred months apart on the same device — suggesting either persistence or re-infection via the same vector. A quarterly wipe-and-restore, or annual hardware rotation for the highest-risk staff, is a blunt but effective counter.
The PEGA committee's original 2023 report already called for an EU-wide moratorium on commercial spyware use pending stricter oversight. That recommendation went nowhere. The forensic proof that a committee member investigating Pegasus was himself being surveilled by a Pegasus customer with cross-border reach is the strongest political argument yet for that moratorium — and the strongest evidence that the member states with the loudest official concerns about spyware are the least likely to vote for one. Expect the next PEGA-successor report to name this incident specifically. Expect nothing to change at the licensing layer. And expect the next MEP investigating the next commercial spyware scandal to get a hardened work phone, use it inconsistently, and file the same forensic report in 2028.
> we note an overlap between the first infection and a previously identified Pegasus campaign targeting Russian and Belarusian-speaking exiled journalists and activists in Europe, suggesting a Pegasus customer with authorization to spy in multiple European countries is responsible.Who has "a
> It is important to note that threat notifications from Apple and other companies are not real-time alerts. They are typically sent to users in batches, often months or more after targeting takes place.Wow, so Apple is able to detect threat, but does not remove or prevent it, and waits silently
Around that time a lot of politicians in Greece had their phones hacked by Pegasus. It's an ongoing scandal in Greece that never got fully resolved, although all evidence indicate that it was an operation orchestrated by the office of the prime minister in coordination with the local intelligen
Isn't it the problem with software architecture choices like large monolitic kernels, lots of unnecessary telemetry/marketing services, legacy APIs, unsafe languages like C, lack of static analysis, etc?You should threat a phone as an infected ground and do not keep anything important ther
Top 10 dev stories every morning at 8am UTC. AI-curated. Retro terminal HTML email.
> In May 2026, Kouloglou contacted the Citizen Lab and we conducted a forensic analysis of artifacts from his iPhone. We found with high confidence that his device was successfully infected with Pegasus spyware on or around October 21, 2022, and again on March 6 and 7, 2023.