Moroccan intelligence insider reveals widespread use of Pegasus hacking software

A Moroccan intelligence insider has exposed how the government used Israeli-made Pegasus spyware to monitor journalists, human rights activists, and foreign officials. The revelations emerged through an international investigation led by Forbidden Stories, Amnesty International, and 13 other media organizations, published on 17 July 2026. The whistleblower, identified under the pseudonym Safir, worked for nearly a decade within the Moroccan domestic intelligence agency, the Direction Generale de la Surveillance du Territoire (DGST). His accounts, supported by leaked documents, targeting records, and forensic analysis by Amnesty International’s Security Lab, detail the systematic deployment of Pegasus since 2017. The investigation traces the initial introduction of Pegasus to Moroccan intelligence officials in 2017 at a villa in Rabat known as “the FSSYS villa.” This location was linked to FSSYS Maroc, the Moroccan branch of the UAE-based surveillance intermediary al-Fahad. Representatives from Israel’s NSO Group, the developer of Pegasus, presented the technology to high-ranking Moroccan intelligence officers and technical experts. During this session, NSO representatives demonstrated the capabilities of Pegasus, remotely infecting test devices and activating cameras and microphones. The demonstration highlighted the software’s ability to access all data on a targeted phone, including messages, photos, and recordings. Safir described the acquisition of Pegasus as a gesture from the United Arab Emirates. He noted that while the UAE paid for the subscription, other allied services, including Morocco, accessed the system as if using a shared account. The whistleblower emphasized that due to the high cost of Pegasus, the DGST reserved its use for high-profile targets after exhausting cheaper surveillance methods. These older tactics included monitoring internet cafes and pressuring shopkeepers to sell pre-infected mobile devices to dissidents. Safir stated that Pegasus was considered the “monster’s weapon” and was deployed only as a final resort. Evidence from the investigation indicates that the DGST began using Pegasus against Moroccan journalists and human rights defenders soon after the 2017 villa meeting. Among the victims were prominent figures such as Aminatou Haidar, a Western Saharan human rights activist, and Igancio Combrero, a Spanish journalist. The scope of the surveillance extended beyond Moroccan borders, with Spanish officials, including Defence Minister Margarita Robles and Interior Minister Fernando Grande-Marlaska, reportedly targeted. Additionally, Spanish civil guards who traveled to Morocco to exchange counter-terrorism expertise were also subjected to Pegasus monitoring. The findings challenge Morocco’s previous denials regarding the use of Pegasus. In response to earlier allegations in 2021, Moroccan authorities rejected claims that the country had employed the spyware to surveil critics or allies. However, the current investigation provides substantial documentation, including leaked emails, training materials, and forensic analyses, suggesting otherwise. The collaboration between multiple media organizations and Amnesty International adds credibility to the whistleblower’s claims, offering a comprehensive view of Morocco’s surveillance operations. The exposure of these activities raises questions about the ethical implications of using advanced surveillance tools and the role of international companies in facilitating such practices. The involvement of the UAE in providing access to Pegasus further complicates the geopolitical landscape, highlighting the interconnected nature of global intelligence networks. As the investigation continues, it is anticipated that further details will emerge, potentially leading to legal actions or policy changes aimed at regulating the use of such invasive technologies.