Pegasus spyware turns inward: MEP investigators become targets—what does it mean for EU oversight?

A new wave of reporting says Pegasus spyware was used against European Parliament figures investigating abuses tied to commercial surveillance tools. In 2022 and 2023, the PEGA Committee probed how governments across the European Union deployed NSO Group’s Pegasus after journalistic revelations. Now, researchers cited by Cyberscoop and The Record report that a spyware probe overseer was infected with Pegasus, and that Stelios Kouloglou—an MEP who served on the committee investigating commercial spyware abuses—was reportedly infected twice while in office. The findings, attributed to forensic work by groups including Citizen Lab and the University of Toronto, suggest the investigation itself may have been compromised. Strategically, this is a direct blow to EU internal accountability mechanisms and raises questions about who benefits from surveillance opacity. If Pegasus was deployed against individuals tasked with oversight, it implies either state-linked actors seeking to protect sources and methods or a broader ecosystem of misuse that can reach into EU institutions. The power dynamic is stark: the EU’s investigative capacity depends on trust, secure communications, and the ability to gather evidence without retaliation. NSO Group is positioned as a central enabler in the narrative, while the PEGA Committee’s credibility and ability to push for enforcement measures could be undermined. For EU member states and Brussels, the political cost is high because the story shifts from “abuses by others” to “abuses that can reach the watchdog.” Market and economic implications are likely to concentrate in cybersecurity, surveillance technology compliance, and insurance/forensics demand rather than in commodity flows. Expect heightened spending on mobile security tooling, incident response, and forensic services across EU institutions and regulated enterprises, with knock-on effects for endpoint security vendors and mobile threat detection providers. The most immediate financial signal would be sentiment toward companies associated with commercial spyware supply chains and toward compliance and monitoring budgets in the EU public sector. While the articles do not name specific tickers, the direction is clear: increased demand for defensive cybersecurity and greater regulatory scrutiny of surveillance vendors can pressure business models reliant on opaque government sales. In parallel, the risk premium for EU-linked cyber incidents may rise, affecting how insurers price cyber coverage and how corporates budget for security controls. What to watch next is whether EU authorities can attribute the infections to specific operators and whether they can secure evidence without further compromise. Key indicators include follow-on forensic reports, any formal PEGA Committee actions, and potential law-enforcement or judicial steps tied to the infections of Kouloglou and the probe overseer. Another trigger point will be whether EU regulators accelerate licensing, export controls, or transparency requirements for commercial spyware technologies. In the near term, the escalation risk is tied to whether additional committee members report infections or if communications security failures spread beyond the initial cases. De-escalation would require credible attribution, rapid containment guidance, and demonstrable institutional safeguards that prevent future targeting of oversight personnel.

Geopolitical Implications

• 01

  Undermines EU institutional credibility and raises the likelihood of retaliatory or protective surveillance by state-linked actors.

• 02

  Forces the EU to confront the governance gap between commercial spyware vendors and member-state accountability.

• 03

  May intensify EU-wide political pressure for stronger cyber/spyware regulation, affecting diplomatic leverage with technology-exporting states.

Key Signals

• —New forensic attribution reports naming likely operators or jurisdictions behind the infections.
• —Formal PEGA Committee actions, subpoenas, or referrals to EU-level or national law enforcement.
• —Regulatory moves on spyware licensing, export controls, and mandatory incident reporting for affected institutions.
• —Additional infections reported by other committee members or EU officials, indicating broader targeting.