A whistleblower who spent nearly a decade inside Morocco's domestic intelligence service has provided detailed testimony revealing how the north African kingdom used Pegasus spyware to systematically surveil journalists, human rights defenders, and senior politicians in both France and Spain. The account, corroborated by leaked documents and forensic analysis, forms the centrepiece of a major collaborative investigation by 14 media organisations — including Le Monde, the Guardian, Haaretz, El Confidencial and Die Zeit — coordinated by the non-profit Forbidden Stories, with technical support from Amnesty International's Security Lab.

Pegasus, developed by the Israel-based NSO Group, is among the most powerful surveillance tools in existence. Once installed on a target's smartphone — without any action required from the user — it grants its operator access to emails, messages, photographs, and call records, and can silently activate the device's microphone and camera. NSO Group maintains that it sells the software exclusively to governments for use against criminals and terrorists, a claim that investigations over several years have cast serious doubt upon.

According to the whistleblower, known by the pseudonym Safir, Morocco's Direction Générale de la Surveillance du Territoire (DGST) — the country's internal security directorate — first acquired Pegasus in 2017 following a demonstration at a villa in the capital Rabat. Safir alleges the software was effectively gifted by the United Arab Emirates, describing the arrangement in vivid terms: "The Emirates bought it and redistributed it to friendly services. You could say it's like Netflix: a friend pays for the subscription, and the others use their account." The DGST began deploying the spyware against domestic targets almost immediately, with the targeting expanding internationally within months.

Among the most significant foreign targets were senior Spanish government figures. Forensic records show that the mobile phones of Prime Minister Pedro Sánchez and Defence Minister Margarita Robles were infected in 2021, during a period of sharp diplomatic tension between Madrid and Rabat over Spain's decision to allow the leader of the Polisario Front — a movement seeking independence for Western Sahara from Moroccan control — to receive medical treatment on Spanish soil. Interior Minister Fernando Grande-Marlaska and Agriculture Minister Luis Planas were also targeted. More than 200 Spanish mobile numbers appear in the Pegasus targeting records attributed to Morocco. Prominent human rights figures were similarly affected, including Aminatou Haidar, a leading activist from Western Sahara, whose phones showed traces of Pegasus infections as recently as November 2021.

Morocco has consistently denied any use of Pegasus against critics at home or abroad. Spanish judicial efforts to investigate the targeting of its cabinet ministers have stalled repeatedly, most recently in January this year when the presiding judge shelved the inquiry, citing a persistent lack of cooperation from Israeli authorities, including NSO Group's failure to respond to requests for testimony. The revelations place renewed pressure on both Morocco and NSO Group, and raise broader questions about the accountability of governments that deploy commercial spyware against political targets across borders.