The Pegasus Files: How a Moroccan Whistleblower Exposed a Decade of Global Surveillance

For years, Morocco has denied using Pegasus spyware to target critics at home or abroad. Reporters who investigated the matter, the government claimed, were "incapable of proving [the country had] any relationship" with NSO Group, the Israeli company that manufactures the powerful surveillance tool. But a former member of Morocco's domestic intelligence service has now provided unprecedented evidence that the country not only used Pegasus — but did so systematically, over a period of years, against journalists, human rights defenders, French politicians, and Spanish cabinet ministers.

The whistleblower, who worked for Morocco's Direction Générale de la Surveillance du Territoire for almost a decade and is known by the pseudonym Safir, has helped to piece together one of the most detailed accounts yet of how a single state deployed commercial spyware on a massive scale. His testimony forms the basis of a multiyear investigation by Moroccan journalist Hicham Mansouri, which has grown into a collaborative effort involving 14 media organisations, including Le Monde, Haaretz, El Confidencial, Die Zeit, and the Guardian, with technical support from Amnesty International's Security Lab. Two other former Moroccan intelligence agents also provided information and corroborated facts.

The story begins in 2017, in an expensive villa in Rabat nicknamed "the FSSYS villa." There, representatives of NSO Group gave high-ranking Moroccan intelligence officers a detailed demonstration of Pegasus and other surveillance technologies. According to Safir, those present immediately grasped the spyware's "revolutionary" potential: its remote-infection capability meant they would no longer need to physically access the mobile phones of their targets. As they watched, NSO representatives infected test phones, remotely activating cameras, switching on microphones, and accessing data and messages.

Pegasus, which NSO Group claims is sold only to governments to track criminals and terrorists, allows its operator to access everything on a target's mobile phone — emails, text messages, photographs — and even activate the device's microphone and camera, turning it into a listening device. The whistleblower suggested that the hugely expensive spyware was a gift from the United Arab Emirates. "Millions for the Emiratis, that's nothing," Safir said. "The Emirates bought it and redistributed it to friendly services. You could say it's like Netflix: a friend pays for the subscription, and the others use their account."

Before Pegasus was adopted, the DGST had relied on a mix of old-fashioned human intelligence and cheaper spyware, even persuading shopkeepers to sell pre-infected mobile phones to dissidents. According to Safir, Pegasus was reserved for high-value targets once other options had been exhausted. "We never start with Pegasus," they said. "It's the monster's weapon."

Evidence gathered by the Pegasus Project investigation reveals that four unique Moroccan mobile phone numbers were selected as Pegasus targets in September 2017 — seemingly to test the fledgling system. The numbers belonged to two DGST staff members, apparently to determine the spyware's capabilities. That same month, the numbers of Moroccan journalists and human rights defenders began appearing in the Pegasus system. Before long, the targeting extended beyond Morocco's borders.

The leaked database at the centre of a previous Pegasus investigation shows that a Spanish mobile number belonging to Aminatou Haidar, a prominent human rights activist from Western Sahara, was targeted as early as 2018. Traces of the spyware were also found on a second phone belonging to Haidar in November 2021. Meanwhile, a Spanish mobile number for the journalist Ignacio Cembrero — whose work focuses on the Maghreb — was also listed on the Pegasus project database.

In total, Pegasus project records show more than 200 Spanish mobile numbers were selected for targeting by the user believed to be Morocco. In May 2022, the Spanish government revealed that the mobile phones of Prime Minister Pedro Sánchez and Defence Minister Margarita Robles had been infected with Pegasus spyware in May and June 2021. The targeting came at a time of diplomatic tension between Madrid and Rabat over Spain's decision to allow the leader of the Polisario Front, which has long fought for the independence of Western Sahara from Morocco, to receive medical treatment in Spain. It later emerged that the phones of Spain's interior minister and agriculture minister had also been targeted.

Repeated judicial attempts to investigate the use of Pegasus against the Spanish cabinet have come to nothing. An investigating judge originally ended the inquiry in July 2023, reopened it a few months later after French authorities provided information on the targeting of French ministers, MPs, lawyers, and journalists, but shelved it again in January 2026, citing a chronic lack of cooperation from Israeli authorities. However, recent analysis points to the DGST being responsible for the targeting of senior Spanish politicians. Court documents show that one of the attacker accounts assigned to Morocco's Pegasus system and used to target politicians, journalists, and human rights defenders in France was also used to target the phones of Robles and Grande-Marlaska.

Despite these suspicions, Grande-Marlaska last year presented Abdellatif Hammouchi, the director general of the DGST, with the highest honour bestowed by Spain's Guardia Civil — a move that angered one Guardia Civil union, which said that giving the award "to a man who has faced international accusations of human rights violations and spying" was an affront to the dignity of the force's officers.

Leaked documents, photographs, and testimony from Spanish security forces and a former Moroccan intelligence agent suggest the DGST used its technical knowledge to seek access to the communications of Guardia Civil officers who had travelled to Morocco to share counter-terrorism expertise. The personal phone number of one senior Guardia Civil officer appears five times on the list of targets selected for Pegasus surveillance by the end-user believed to be Morocco. "We spy on everyone," one former DGST officer told the consortium, adding that such targeted surveillance was carried out "just in case." A senior Guardia Civil official described the revelations of spying on his force as "a betrayal."

Further evidence that Morocco used Pegasus emerged last year after Meta took NSO Group to court in the US for exploiting WhatsApp to target people. An unsealed presentation given to the board of NSO Group's parent company in early August 2018 includes a list of Pegasus end-user codenames. According to Haaretz, countries using Pegasus are assigned a name based on the first letter of that country and the name of a car manufacturer. Morgan has now been identified as Morocco after former NSO employees confirmed to the consortium that Morocco was a Pegasus end-user and was known by that codename.

In November 2021, NSO Group was placed on a US blacklist after the Biden administration determined the company had acted "contrary to the foreign policy and national security interests of the US." Three weeks later, the Israeli financial newspaper Calcalist reported that Israel's defence ministry had barred exports of Israeli cyber-technology to a number of countries, including Morocco and the UAE. The investigation has not found any evidence of Pegasus-aided surveillance in Morocco after late 2021.

For now, the story of Morocco's Pegasus operation is a tale of power, impunity, and the ease with which surveillance technology can be turned against those who challenge authority. The whistleblower has spoken, the evidence has been compiled, and the victims have been identified. But justice remains elusive. Spain's judges have hit a wall. Morocco continues to deny. And NSO Group, despite being blacklisted, continues to operate. The Pegasus Project has exposed the machinery. Whether anyone will be held accountable is another question entirely.

Written by Freya Stensrud freya.stensrud@alpineweekly.com