Full Breakdown
Morocco’s Secret Pegasus Campaign: Inside a Four-Year Spy Operation
7/16/2026, 9:44:22 PM
Core Event
A former employee of Morocco’s domestic intelligence service, identified only as “Safir,” disclosed that the Directorate Générale de la Surveillance du Territoire (DGST) began using the Israeli-made Pegasus spyware in September 2017. Over the next four years the agency deployed the tool against journalists, human-rights defenders, and foreign officials—including Spanish cabinet ministers, French MPs, and a Western-Sahara activist—by remotely infecting their smartphones.
Background & Context
Pegasus, sold by Israel’s NSO Group, can silently access messages, emails, photos and activate a phone’s camera and microphone. Although NSO claims the software is sold only to governments for counter-terrorism, the 2021 “Pegasus Project” first linked Morocco to its use. Subsequent investigations by a consortium of 14 media organisations (co-ordinated by Forbidden Stories and supported by Amnesty International’s Security Lab) uncovered internal training material, leaked emails and targeting records that corroborate Safir’s testimony.
Key Figures & Groups
- Safir – former DGST operative, primary whistle-blower.
- Abdellatif Hammouchi – director-general of the DGST, later honoured by Spain’s Guardia Civil.
- Wassim F. – cybersecurity specialist at FSSYS Maroc, the Moroccan branch of UAE-based al-Fahad, which hosted the 2017 Pegasus demonstration in Rabat.
- Spanish officials – Prime Minister Pedro Sánchez, Defence Minister Margarita Robles, Interior Minister Fernando Grande-Marlaska and Agriculture Minister Luis Planas.
- French officials – Ministers Emmanuel Macron, Sébastien Lecornu and others whose phones showed Pegasus markers linked to Morocco.
Data & Statistics
- Four Moroccan numbers were used to test Pegasus in September 2017.
- More than 200 Spanish mobile numbers were listed as targets.
- Pegasus markers were found on the phones of at least seven French ministers in 2019-2020.
- The spyware was also used against Western-Sahara activist Aminatou Haidar (targets in 2018 and November 2021).
Why It Matters
The operation demonstrates how a North-African state leveraged a costly foreign cyber-tool—facilitated by a UAE intermediary—to surveil domestic dissenters and foreign policymakers. Targeting senior officials of Spain and France occurred amid diplomatic tensions, notably over Spain’s treatment of Polisario Front leader Brahim Ghali. The revelations raise questions about the effectiveness of international export controls, the accountability of intelligence services, and the vulnerability of democratic institutions to covert foreign-origin surveillance.
Official Statements & Responses
Moroccan authorities have repeatedly denied any link to Pegasus, asserting that journalists “incapable of proving” any relationship with NSO. Spain’s interior ministry has not commented on the specific allegations, though it noted that the investigation into the spyware was repeatedly reopened and then shelved due to lack of cooperation from Israel. French officials have not publicly addressed the alleged infections, but a French intelligence source confirmed that several state services, including the DGSI and the Ministry of Justice, had shown interest in acquiring Pegasus before the Élysée vetoed the purchase at the end of 2020.
Criticism & Opposition
Human-rights groups and journalists argue that Morocco’s use of Pegasus constitutes a breach of fundamental freedoms and international law. The Guardia Civil union condemned the award given to DGST chief Hammouchi as “an affront to the dignity of the force’s officers.” Legal scholars note that the lack of transparent judicial oversight in Morocco hampers accountability for such surveillance.
On-the-Ground Reports
Victims, including journalist Ignacio Cembrero and activist Aminatou Haidar, reported unexplained device behavior and later confirmed forensic traces of Pegasus on their phones. A senior Guardia Civil intelligence officer described the revelations as “a betrayal,” noting that officers had assumed mutual trust with Moroccan counterparts.
Conflicting Reports & Gaps
While the consortium’s forensic analysis links the targeting to DGST, Moroccan officials have not provided documentation to confirm or refute the claims. The investigation found no evidence of Pegasus-aided surveillance in Morocco after late 2021, leaving the later phase of the operation unclear.
Verbatim Quotes
- “Millions for the Emiratis, that’s nothing,” — Safir, former DGST agent
- “We never start with Pegasus,” — Safir
- “We spy on everyone,” — former DGST officer
- “a betrayal” — senior Guardia Civil official
- “An intermediary leaves no trace,” — Safir
- “« Emmanuel Macron announced it during a defense council and invoked reasons of sovereignty as well as reputational risk, as the spyware was already being used by authoritarian regimes, » a source close to the matter confirmed to Forbidden Stories.” — source close to the matter
What’s Next
Spanish judicial authorities have reopened the Pegasus inquiry, and French prosecutors continue to examine the forensic evidence of compromised ministers’ phones. International watchdogs are calling for stricter export-control regimes on cyber-surveillance tools.
