A Spy Tool Was Used to Watch the Spy Investigators

Stelios Kouloglou sat on the European Parliament's PEGA Committee — the body set up specifically to investigate how Pegasus spyware was being misused across Europe. According to a new Citizen Lab report, his iPhone was infected with Pegasus at least three times while he served on that very committee.

Pegasus is a commercial surveillance tool made by Israeli firm NSO Group. Once on a phone, it can silently read messages, listen through the microphone, access documents, and monitor calls. The attacker used a zero-click exploit (a method requiring no action from the target — no tap, no link, nothing) in Apple's HomeKit smart home software, codenamed PWNYOURHOME. Kouloglou's phone was running iOS 15.5 at the time of each infection; Apple patched the exploit in iOS 16.3.1.

The infections occurred on October 21, 2022, and again on March 6 and 7, 2023 — the second set coinciding with final drafting discussions for the committee's report. Citizen Lab found evidence that confidential documents and committee deliberations may have been exposed.

No government has been formally attributed. However, Citizen Lab noted an overlap between the first infection and a separate campaign targeting Russian and Belarusian-speaking journalists and activists in Europe, suggesting a single Pegasus operator with reach across multiple EU countries.

Kouloglou received Apple's mercenary spyware threat notifications on three separate occasions. He is the first confirmed PEGA Committee member publicly identified as a Pegasus target while serving.

What you should do: Enable Lockdown Mode on your iPhone if you are a journalist, activist, or work in any politically sensitive role. Go to Settings → Privacy & Security → Lockdown Mode. It restricts some functionality but blocks the class of exploits used here.

Researchers at JFrog have linked a fresh batch of malicious npm packages (software libraries that developers install into their projects) to North Korean threat actors, in a report covered by The Hacker News. The packages impersonate legitimate Rollup polyfill tools — Rollup is a popular JavaScript bundler — copying descriptions, metadata, and naming patterns closely enough to pass a quick review.

The attack is a supply chain attack (where malware is hidden inside a trusted software dependency rather than delivered directly). Once installed, a hidden second-stage payload reaches out to an external server, decrypts a JavaScript loader, and hands the attacker full remote control: keystrokes, screenshots, clipboard contents, and credentials stored in browsers, crypto wallets, and developer tools including AWS, Azure, and Anthropic Claude configurations.

This is not the first time this group has targeted Rollup-adjacent tooling. If you are a developer, audit your dependency list before adding anything new.

CVE ID confirmed in source — see the full runZero advisory before acting.

What FatFs is: FatFs is a tiny open-source library that lets embedded devices — security cameras, drones, hardware crypto wallets, industrial controllers — read and write USB drives and SD cards using the FAT and exFAT formats found on most removable storage.

What it is: An integer overflow (a maths error where a calculation wraps around and produces a nonsense result) in the code that mounts a FAT32 volume can generate a false file size. Downstream memory operations treat that false value as real, which can corrupt the device's memory and allow an attacker to run their own code.

Who's at risk: Any device running firmware that uses FatFs to handle removable storage or firmware update files. This includes consumer IoT products, industrial equipment, drones, and crypto wallets built on platforms such as Espressif ESP-IDF, Zephyr, MicroPython, ArduPilot, and others. Physical access to a USB or SD slot is the most common trigger, though some firmware update flows can be reached without physical media at all.

CVSS: 7.6 (High) — patch this week. Do not delay.

Attack vector: An attacker crafts a malformed FAT32 storage image on a USB drive or SD card and inserts it into the target device. FatFs processes the volume header, the integer overflow fires, and the resulting false size value propagates into memory operations without further validation. On hardware lacking standard memory protections — common in embedded systems — this becomes code execution. Some firmware update pipelines that parse FAT volumes can trigger the same path remotely.

Recommended actions:

1. If you build firmware that handles FAT or exFAT media, audit which version of FatFs you bundle and apply any vendor-supplied patches immediately.
2. Check whether your platform vendor (Espressif, STMicroelectronics, Zephyr, etc.) has issued a patched SDK release and update to it.
3. Where possible, restrict physical access to USB and SD ports on deployed devices — especially kiosks, ATMs, or public-facing hardware.

A joint operation involving Google, the FBI, and Lumen Technologies has disrupted NetNut, a residential proxy botnet that had quietly compromised at least two million Android devices — smart TVs, streaming boxes, and phones — according to Bleeping Computer. Infected devices were used to route criminal and espionage traffic through ordinary home internet addresses, making the traffic look legitimate.

Devices typically get infected through pre-installed malware or trojanized apps downloaded outside the official Play Store.

What to do right now:

1. Open the Google Play Store, tap your profile icon, and select Play Protect → Scan. Google has been automatically disabling infected apps for enrolled devices.
2. Avoid sideloading apps (installing from outside the Play Store) on Android TV boxes or streaming sticks.
3. If you use a cheap Android streaming device from an unfamiliar brand, consider replacing it with a device that receives regular security updates.

The Citizen Lab's findings about MEP Stelios Kouloglou carry a direct policy implication: Pegasus was apparently deployed against a member of the EU's own investigative committee while it was actively probing Pegasus abuse. The PEGA Committee ran from March 2022 to mid-2023 and produced formal recommendations for restricting commercial spyware across the bloc. If committee deliberations were accessed during drafting, the integrity of that process is now a live question for EU regulators. Read the full Citizen Lab report here.