A former member of Morocco's domestic intelligence service has provided unprecedented insight into how the country used Pegasus spyware to target journalists, human rights defenders, French politicians, and Spanish cabinet ministers and police officers.
Pegasus, developed by Israel-based NSO Group, allows operators to access everything on a target's mobile phone, including emails, messages, and photos, and can activate the camera and microphone.
Morocco has long denied using Pegasus against critics, but evidence from a whistleblower who worked for the Direction Générale de la Surveillance du Territoire (DGST) for nearly a decade suggests the service began using the spyware in 2017.
The whistleblower, known by the pseudonym Safir, testified that Morocco deployed Pegasus against domestic and foreign targets over four years.
His account forms the basis of a multiyear investigation by Moroccan journalist Hicham Mansouri, supported by Amnesty International's Security Lab and a consortium of 14 media organizations.
According to the investigation, NSO representatives demonstrated Pegasus to Moroccan intelligence officers in a villa in Rabat in 2017.
The source said the house was nicknamed "the FSSYS villa" after FSSYS Maroc, a branch of UAE-based surveillance intermediary al-Fahad.
Those present immediately recognized Pegasus's potential, as its remote-infection capability eliminated the need to physically access targets' phones.
NSO representatives infected test phones, remotely activating cameras and microphones.
The whistleblower suggested the spyware was a gift from the UAE. "Millions for the Emiratis, that's nothing," Safir said.
"The Emirates bought it and redistributed it to friendly services."
Before Pegasus, the DGST relied on human intelligence, targeting terminals in internet cafes, and infecting phones with other spyware.
Safir said Pegasus was used only for high-value targets after cheaper options were exhausted. "We never start with Pegasus.
It's the monster's weapon," he explained.
In September 2017, four Moroccan mobile numbers were selected as Pegasus targets to test the system, including numbers linked to two DGST staff members.
That same month, numbers of Moroccan journalists and human rights defenders began appearing in the system.
Expanding Across Borders into Spain
A Spanish mobile number belonging to Western Sahara activist Aminatou Haidar was targeted by Pegasus from 2018, with traces found on a second phone in November 2021.
The number of journalist Ignacio Cembrero, who focuses on the Maghreb, was also listed.
Pegasus project records show more than 200 Spanish mobile numbers were selected for targeting by the user believed to be Morocco.
In May 2022, Spain revealed that the phones of Prime Minister Pedro Sánchez and Defense Minister Margarita Robles were infected in May and June 2021.
The targeting occurred during a diplomatic row over Spain allowing the leader of the Polisario Front to be treated for Covid-19 in a Spanish hospital.
The phones of Interior Minister Fernando Grande-Marlaska and Agriculture Minister Luis Planas were also targeted.
Judicial attempts to investigate the Pegasus targeting have stalled.
An investigating judge closed the case in July 2023, reopened it after France provided information on Pegasus infections of French officials, but shelved it again in January 2024 due to lack of cooperation from Israeli authorities.
Recent analysis points to the DGST being responsible for targeting the Spanish politicians.
Material shows an attacker account assigned to Morocco's Pegasus system used to target French officials was also used to target Robles and Grande-Marlaska.
Despite suspicions, Grande-Marlaska last year awarded DGST director Abdellatif Hammouchi the highest honor of Spain's Guardia Civil.
A Guardia Civil union criticized the move, saying it was an affront to officers' dignity.
A Betrayal of Bilateral Trust
Leaked documents and testimony suggest the DGST sought access to communications of Guardia Civil officers who traveled to Morocco to share counter-terrorism expertise.
The personal phone number of a senior Guardia Civil officer appears five times on the Pegasus target list.
"We spy on everyone, just in case," a former DGST officer said. A senior Guardia Civil official described the revelations as "a betrayal."
Unlike Policía Nacional officers, who use separate devices for sensitive information when traveling to Morocco, the Guardia Civil did not take such precautions with an ally.
Further evidence emerged after Meta took NSO Group to court in the US. An unsealed presentation from August 2018 lists Pegasus end-user codenames.
According to Haaretz, countries are assigned names based on the first letter of the country and a car manufacturer.
"Morgan" has been identified as Morocco after former NSO employees confirmed it.
In November 2021, NSO Group was placed on a US blacklist.
Three weeks later, Israel's defense ministry barred imports of Israeli cyber-technology to several countries, including Morocco and the UAE.
The investigation found no evidence of Pegasus-aided surveillance in Morocco after late 2021.
