A former member of Morocco's domestic intelligence service has provided testimony and documents to an international media consortium detailing how the kingdom deployed Pegasus spyware and other surveillance tools against journalists, human rights defenders and senior European political figures over nearly a decade.
The revelations, published on 16 July by a consortium of 16 news organisations coordinated by Forbidden Stories with technical support from Amnesty International's Security Lab, represent the most detailed account yet of the inner workings of Morocco's surveillance apparatus — and come with a sharp diplomatic edge: the same day the investigation was published, French Prime Minister Sébastien Lecornu was in Rabat signing a new partnership agreement and hailing "exceptionally positive" ties with the kingdom.
What the insider revealed
The former agent of the Direction Générale de la Surveillance du Territoire (DGST) described a surveillance operation that began well before Pegasus. According to the consortium's reporting, Morocco's intelligence services were using RCS spyware, produced by the Italian firm Hacking Team, as early as 2009 — with an "industrial" scale licence that allowed widespread deployment.
Pegasus, the more powerful tool developed by Israel's NSO Group, was acquired later. The consortium's investigation, dubbed "Codename Morgan," traced the acquisition through product demonstrations at a secret villa in Rabat — nicknamed "Villa FSSYS" by DGST agents — and training sessions at NSO's headquarters in Herzliya, Israel. The United Arab Emirates was also involved in facilitating the deal.
A dedicated "Systems Department" within the DGST, led by an official identified as El Hani, was responsible for deploying and operating Pegasus, according to the insider's account. The targeting was not limited to the kingdom's own dissidents.
Who was targeted
The consortium identified more than 200 Spanish mobile numbers selected for Pegasus targeting by what was believed to be a Moroccan user. Senior Spanish officials, including cabinet ministers, were among those targeted. Aminatou Haidar, a prominent Western Saharan human rights activist, and Ignacio Cembrero, a Spanish journalist, were specifically named.
Perhaps most strikingly, the investigation found that Moroccan intelligence also targeted Spanish Guardia Civil officers who were secretly training Morocco's own intelligence service — an act that would constitute a serious breach of trust between allied security services.
On the French side, traces of Pegasus compromise linked to Morocco were found on the smartphones of seven former French ministers who were in office between 2019 and 2021. In 2023, the investigating judge at the Paris judicial court classified these seven ministers among 23 identified "victims" of Pegasus, alongside Mediapart journalists Edwy Plenel and Lénaïg Bredoux.
Sébastien Lecornu himself — now France's prime minister — was reportedly targeted in July 2019, when he was still serving as minister of local authorities. Former defence minister Florence Parly was targeted in March 2020.
A senior French intelligence official told the consortium they were never informed of the results of the analysis of President Macron's phone, which was handled directly by the Élysée Palace.
Who authorised it
The insider's testimony suggests that Pegasus deployments were authorised within the DGST's internal chain of command, with the Systems Department carrying out operations under senior official oversight. The consortium's reporting describes a structure in which surveillance targets — both domestic and foreign — were selected and processed through the intelligence service's own operational procedures.
Morocco has consistently denied using Pegasus. The kingdom continues to reject the findings, despite the 2021 Pegasus Project revelations and this new round of evidence.
The France angle: buyer and target
One of the investigation's most uncomfortable revelations concerns France itself. According to the consortium, several French government departments explored acquiring Pegasus between 2019 and 2020 — the very period when Morocco was allegedly using the same software to spy on French ministers.
The French Ministry of Justice was reportedly interested in using Pegasus for investigations linked to drug trafficking and terrorism. Multiple state services pushed in favour of the purchase. The Élysée Palace ultimately vetoed the acquisition in a sudden reversal, though the consortium notes that nothing indicates the uses France contemplated would have been illicit.
The timing is pointed: France was considering buying the tool while simultaneously being targeted by it.
Legal and diplomatic consequences
A French judicial investigation into the Pegasus espionage targeting journalists and French leaders has been ongoing since 2021. The Paris investigating court has already identified victims, but the investigation has not produced public charges against Moroccan officials.
Despite the fresh revelations, the diplomatic response has been muted. On the day the investigation was published, Prime Minister Lecornu was in Rabat for an official visit where he praised the "exceptionally positive" state of France-Morocco relations and moved to deepen cooperation on energy and other fronts.
A senior French intelligence official told the consortium they were never briefed on the results of the analysis of the president's compromised phone.
Amnesty International's Security Lab published its most comprehensive technical analysis of Pegasus to date alongside the investigation, drawing on previously unpublished internal NSO Group marketing material.
Haaretz, participating in the consortium, separately reported that NSO Group's founder reportedly held a diplomatic passport — a detail that raises further questions about the relationship between the company and state actors.
The coverage
This is not a single-outlet scoop. The investigation involves 16 newsrooms across multiple countries: Le Monde and franceinfo (France), The Guardian (UK), Haaretz (Israel), Amnesty International's Security Lab, Forbidden Stories (coordinating), and Radio France's investigative unit, among others. Eighteen independent sources carried the reporting — not a wire echo, but a coordinated consortium investigation.
Morocco's denial has been consistent across all five years of revelations. The kingdom has not engaged with the specific documentary and testimonial evidence presented in this latest round.
