Dániel Németh, a Budapest-based photojournalist, has tried to keep a low profile in his groundbreaking work investigating and documenting the luxury lifestyle of Hungary’s ruling elite.

While his name is not well known, the 46-year-old has managed to use his drone, and public flight and ship tracking data, to find and photograph politicians and pro-government business figures, exposing their hidden luxuries such as yachts in exotic locations.

Now, it has emerged, someone was watching him, too.

An investigation by Direkt36, an investigative media outlet and member of the Pegasus Project consortium, which has investigated NSO Group, has revealed that two of Németh’s phones were recently hacked by a government client of the Israeli spyware company.

Forensic analysis of Németh’s phones, conducted by researchers at Citizen Lab at the University of Toronto and confirmed by researchers at Amnesty International’s security lab, found that the phones were infected with NSO Group’s Pegasus surveillance software, which enables users to monitor a victim’s phone conversations, text messages, pictures and physical location. The spyware can also turn a mobile phone into a remotely operated listening device.

The hacks occurred in July 2021 while Németh was reporting on the whereabouts of one of the prime minister, Viktor Orbán’s, childhood friends, Lőrinc Mészáros, a former gas fitter who has become one of Hungary’s richest men in the past few years.

Mészáros has built a business empire that sprawls across multiple sectors since Orbán came to power in 2010, and his companies often win lucrative government tenders. In 2019, Forbes named him the richest person in Hungary.

Orbán has repeatedly declined to comment on Mészáros’s meteoric rise in fortunes, saying politics and business should be kept separate. Mészáros shuns media attention, but in a 2014 interview with a Hungarian outlet attributed his success to “God, luck and Viktor Orbán”.

A spokesperson for Mészáros’s company said in a statement: “Mr Mészáros does not pay attention to neither Dániel Németh, nor any other paparazzi’s activities, whereabouts or incidents related to them.”

While it cannot be forensically proven which of NSO’s clients targeted Németh, because such analysis examines only whether a phone has been infected, the new revelation comes as Orbán’s far-right government is facing scrutiny in Brussels for its alleged use of the Pegasus spying tool against journalists, media owners, and political opposition figures.

Didier Reynders, the European Commission’s justice commissioner, recently told MEPs that the bloc “totally condemned” alleged attempts by national security services to illegally access information on political opponents through their phones. Reynders said that the EU’s executive branch was closely following an investigation by Hungary’s data protection authority into claims that Orbán’s government was using the spy tool improperly.

A consortium of 17 media outlets, which included the Guardian and was coordinated by the French media non-profit Forbidden Stories, revealed in July that global clients of NSO had used hacking software to target human rights activists, journalists and lawyers. Among those hacked using Pegasus were two Direkt36 journalists, András Szabó and Szabolcs Panyi.

Hungarian law provides that in cases where national security is at stake, the intelligence services can order surveillance with no judicial oversight, only the signature of the minister of justice. Hungary’s justice minister, Judit Varga, has declined to comment, but said: “Every country needs such tools”.

A spokesperson for the Hungarian government did not respond to a request for comment.

NSO has said its spyware is intended to be used only by licensed law enforcement agencies against suspected terrorists and criminals. The company has said that it does not have access to data of its customers’ targets and that it investigates all credible claims of misuse.

NSO declined to comment on the case specifically.

After the Pegasus Project was published in July, documenting cases of abuse of NSO technology by government clients, Németh approached Citizen Lab through an acquaintance and asked the researchers to analyse his phones. The researchers found traces of the spyware on the devices, prompting Németh to alert Direkt36. The media outlet then asked experts at Amnesty Tech, the security lab of AI, to conduct a second analysis of the phones. Amnesty’s forensic analysis showed that Németh’s two phones were successfully hacked with Pegasus spyware, one from 1-9 July 2021 and the other from 5-9 July.

During this period, Németh was in Hungary after returning from a reporting trip in southern Italy, where he was tracking the movements of Mészáros.

“Amnesty Tech’s confirmation of a Pegasus infection on Dániel Németh’s device is yet another outrageous example of how NSO Group’s spyware is being used as a tool to silence journalists,” said Likhita Banerji, a researcher at Amnesty Tech.

A security officer formerly with one of Hungary’s intelligence services told Direkt36 that, according to his knowledge, Hungarian services started using Pegasus in 2018. The Hungarian government has not denied that it uses Pegasus, nor did it deny the surveillance of the people Direkt36 has reported about.

John Scott-Railton, a senior researcher at Citizen Lab, said the case showed the way in which the Hungarian government was seeking to target “politically inconvenient” people who were reporting on individuals close to the government.

“Yet again, this is targeting a journalist. There is no excuse for it and no reason to believe that Hungary is using it for legitimate purposes. It seems pretty clear what is going on,” Scott-Railton said.

On Németh’s most recent mission – which involved two trips to Naples, Italy – he had decided to leave his usual iPhone at home, and relied instead on an older device with a prepaid sim card. The phone had not been active in so long that he was forced to reactivate the sim. The very next day, forensic analysis shows, that phone was also hacked.