NSO Group’s Pegasus Spyware Used to Hack EU Politician’s Phone

A government customer of NSO Group used the company’s Pegasus spyware to hack the phone of a European politician who was serving on an EU committee investigating the spyware industry. The incident raises questions about the accountability of firms like NSO Group.

The politician, whose identity has not been disclosed, was part of an EU committee investigating the spyware industry. The hack highlights the potential for abuse of tools designed for law enforcement and intelligence agencies. NSO Group has consistently denied allegations of enabling human rights violations, stating that its technology is sold only to governments for legitimate purposes.

The discovery of the breach came after the EU committee began investigating reports of spyware being used against journalists, activists, and political figures. The committee’s work has been a focal point for debates over digital privacy and the regulation of surveillance technologies. The revelation that a member of this committee was targeted with Pegasus underscores the risks of such investigations and the challenges of maintaining security in politically sensitive environments.

NSO Group’s Pegasus software has been linked to numerous high-profile cases of surveillance. The tool can infiltrate smartphones, extracting messages, emails, and even activating microphones and cameras without user interaction. NSO Group has since restructured its client verification process, but the latest incident suggests ongoing vulnerabilities in its oversight.

The European Commission has not publicly commented on the specific case, but the EU has been increasingly vocal about regulating surveillance technologies. The latest report could intensify pressure on the EU to enforce these regulations more rigorously.

Cybersecurity experts have called for greater accountability for companies like NSO Group. “This incident demonstrates the urgent need for independent audits of surveillance technology vendors,” said a researcher at the Citizen Lab, a Toronto-based digital rights organization. “When tools designed for national security are used to target individuals involved in oversight, it erodes public trust in both the technology and the institutions that regulate it.”

The case also raises questions about the role of governments in enabling such breaches. While NSO Group claims it does not sell to “bad actors,” the European politician’s attacker is believed to be a state-sponsored entity. This aligns with previous findings that Pegasus has been deployed in countries with poor human rights records. However, the lack of a clear public investigation into the breach has left many details unverified, including the exact timeline and methods used.

For the EU committee, the incident could have lasting implications. Members have previously criticized the lack of transparency around spyware use, and this case may prompt calls for more robust protections for individuals involved in such oversight roles. Some lawmakers have suggested that the EU should establish a dedicated body to monitor and respond to surveillance threats, particularly those involving commercial tools like Pegasus.

The broader tech industry has also taken note. Major platforms like Apple and Google have repeatedly updated their security protocols to counter Pegasus, but the software’s ability to exploit zero-day vulnerabilities remains a concern. The case is ongoing, but the latest report could add momentum to legal and regulatory actions against the firm.