- summary
- Forensic analysis found that the phone of Stelios Kouloglou was infected with NSO Group's Pegasus three times — on 21 October 2022 and on 6–7 March 2023 — while he served as a substitute member of the European Parliament's committee of inquiry into Pegasus and equivalent spyware (PEGA). The operator has not been identified. The findings were made public in July 2026.
- country
- Greece
- date text
- 21/10/2022
- entities
- Unidentified Pegasus customer (NSO sells only to governments)
- entity type
- Security Apparatus (suspected, unattributed)
- id
- 1159
- name
- Unidentified Pegasus customer (NSO sells only to governments)
- role
- actor
- Stelios Kouloglou, investigative journalist and then MEP, substitute member of the European Parliament's PEGA committee on spyware
- entity type
- Individual — Politician / Journalist
- id
- 1160
- name
- Stelios Kouloglou, investigative journalist and then MEP, substitute member of the European Parliament's PEGA committee on spyware
- role
- target
- Unidentified Pegasus customer (NSO sells only to governments)
- sources
- tactics
- Surveillance Infrastructure / Spyware Deployment
- label
- Surveillance Infrastructure / Spyware Deployment
- code
- TC-21
- needs review
- false
- role
- primary
- Direct Intimidation of Journalists and Civic Actors
- label
- Direct Intimidation of Journalists and Civic Actors
- code
- TC-51
- needs review
- false
- role
- secondary
- Surveillance Infrastructure / Spyware Deployment
- channels
- Covert spyware infection (Pegasus)
- civic response
- More than 40 organisations and experts, including Amnesty, Access Now, RSF and Privacy International, issued a joint statement (6 July 2026) demanding an independent investigation, action on the PEGA recommendations, remedies for victims and stronger export controls.
- consequence category
- Operational Suppression
- created at
- 2026-09-25T12:58:49.565817+00:00
- date precision
- day
- escalation
- 5
- harm track
- Track 3 — Operational Suppression
- id
- GRC-002
- institutional consequence
- Data seizure/exposure; Chilling effect on parliamentary oversight
- notes
- Coded Sep 25 2026. Pegasus, not Predator. Date = first infection; further infections 6–7 Mar 2023. Target was investigating spyware abuse at EU level.
- occurred on
- 2022-10-21
- response ids
- trigger type
- TR-08: Proactive / Ambient
- updated at
- 2026-09-25T12:58:49.565817+00:00
- version
- 1
The public research collection