PEGA Committee Member Kouloglou Hit by Pegasus via PWNYOURHOME Zero-Click on iOS 15.5

Forensic artifacts recovered in May 2026 showed HomeKit lookups at 10:16 on 21 October 2022 followed by Pegasus processes on mobile data; identical activity reappeared 6–7 March 2023. Both runs exploited the PWNYOURHOME zero-click in iOS 15.5, fixed only in 16.3.1. Apple threat notifications arrived March 2023, August 2023 and April 2024, confirming mercenary spyware targeting. The same operator email links the first infection to a prior campaign against Russian- and Belarusian-speaking exiles across multiple EU states, proving at least one Pegasus licensee held cross-border authorization while the committee examined exactly those licenses. Kouloglou’s hospital stay and contact with Predator victim Thanasis Koukakis during the initial compromise window further narrows the operational window. No technical attribution to Athens exists; official Greek denials remain untested against NSO licensing records. The pattern—targeting the investigator while hearings were live—matches prior cases where oversight bodies were penetrated before reports could constrain sales. EU procurement of equivalent tools continues without mandatory audit trails. Next reporting cycles will show whether other PEGA members received comparable notifications and whether the Parliament mandates forensic baselines for all committee devices before the next mandate renewal vote.