A former Moroccan intelligence officer has provided the most detailed insider account to date of how the kingdom’s domestic security service, the DGST, systematically deployed NSO Group’s Pegasus spyware against journalists, human rights defenders, and senior foreign politicians. The testimony, published by the Forbidden Stories consortium and corroborated by leaked internal documents and forensic analysis from Amnesty International’s Security Lab, states that Morocco began using Pegasus in 2017 after receiving it as a “gift” from the United Arab Emirates. The whistleblower, identified by the pseudonym Safir, described the tool as “the monster’s weapon,” reserved for high-value targets once cheaper surveillance methods had been exhausted.

According to the consortium, technical analyses by France’s cybersecurity agency ANSSI identified compromise indicators on the phones of at least seven serving or former French ministers, including Sébastien Lecornu, Florence Parly, and Jean-Michel Blanquer. A confidential note from the DGSE, France’s external intelligence service, dated November 2022 and cited by the investigation, assesses that Morocco and the UAE have used NSO products since at least 2017. Separately, the consortium reports that several French security and justice agencies studied acquiring Pegasus themselves between 2019 and 2020 for counter-terrorism and anti-narcotics operations, with discussions reaching an advanced stage and a projected cost of €60–80 million. The project was abandoned in late 2020 after an Élysée arbitration, with President Macron citing technological sovereignty and reputational risk, according to testimony gathered by the journalists.

Viewed from Madrid, the revelations intersect with a major diplomatic crisis. Spanish intelligence reports cited by the investigation assert that the surveillance of Spanish officials, including Prime Minister Pedro Sánchez, occurred in May 2021 as Rabat sought to pressure Madrid to shift its stance on Western Sahara. The CNI documents attribute the coordination of this pressure strategy to King Mohammed VI’s inner circle, specifically royal advisor Fouad Ali El Himma. Sánchez’s phone was infected for a second time, and 2.57 gigabytes of data were extracted just days before over 10,000 people crossed irregularly into the Spanish enclave of Ceuta. Months later, Spain formally endorsed Morocco’s autonomy plan for Western Sahara in a letter from Sánchez to the king.

Morocco has consistently denied ever acquiring or using Pegasus, and its legal challenges against media outlets in France were definitively dismissed in 2024. However, French investigating magistrates, cited by the consortium, note that Rabat has not responded to mutual legal assistance requests, and Israeli authorities have also not cooperated. The technical evidence gathered so far is considered indicative but does not yet constitute formal judicial attribution, according to the French investigation. The dossier remains open, with the lack of international cooperation continuing to stall progress, even as the French prime minister’s current visit to Morocco underscores the diplomatic sensitivities surrounding the case.