What Are Notable Research Findings Published by The Citizen Lab?

The Citizen Lab's published work spans targeted surveillance, disinformation, and digital transnational repression, with several findings drawing international attention because they identified spyware infections or influence operations against specific people and institutions. The three findings below are documented on the organization's site with dated research notes or reports, and each illustrates a different threat category.

Pegasus Spyware Infection of a Serbian Pro-Democracy Student Activist

Published September 2, 2026, under the Targeted Surveillance focus area.

• What was found: In collaboration with the SHARE Foundation, the Citizen Lab confirmed that the iPhone of a member of Serbia's student protest movement was infected with Pegasus spyware.
• Why it matters: The finding links commercial spyware to surveillance of a domestic pro-democracy movement rather than a foreign intelligence target.
• How to read it: The value of this research is the forensic confirmation itself — a device-level finding that turns an allegation into a documented infection.

Espionage Against the European Parliament

Published July 3, 2026, under Targeted Surveillance.

• What was found: Former Member of the European Parliament Stelios Kouloglou was hacked with Pegasus spyware while serving on the PEGA committee, which investigated Pegasus and other spyware abuses in Europe.
• What the forensic analysis showed: Attackers could have had access to confidential documents and committee deliberations.
• Why it matters: This is a case where the target was simultaneously a spyware investigator and a spyware victim, which raises direct questions about interference with legislative oversight.

BlackCore's Influence Operations for Hire

Published September 17, 2026, under Disinformation.

• What was found: The research note examines the digital infrastructure of BlackCore, an Israeli influence-for-hire company.
• The campaign described: A BlackCore campaign consisting of a training program provided to government employees in Angola, including the launch of a supervised influence operation.
• Why it matters: It documents influence operations as a purchasable service delivered to state clients, rather than as a purely domestic propaganda effort.

How These Findings Fit Together

Two of the three findings are spyware infections confirmed through device forensics, and one is an infrastructure-level analysis of a commercial influence operation. Together they show the Lab's method: identify a specific target or operator, document it with technical evidence, and publish the result.

Where to Go Next

If you want to assess the Lab's research output more broadly, the site organizes its work into Focus Areas — App Security & Privacy, Artificial Intelligence, Censorship, Digital Transnational Repression, Disinformation, Law & Policy, Mass Surveillance, and Targeted Surveillance — and maintains a Research Publication Directory, Tools & Resources, and a newsletter subscription for new research. Reading the full reports rather than the summaries is the better route if you need the underlying technical detail.