A former officer inside Morocco's domestic intelligence service, the DGST, has broken silence to confirm that Morocco deployed NSO Group's Pegasus spyware against journalists, human rights defenders, French politicians, Spanish cabinet ministers, and Spanish police officers over a four-year period beginning in 2017.

The whistleblower, using the pseudonym Safir, worked within the DGST for almost a decade. Two other former Moroccan intelligence agents provided information and corroborated facts for the investigation, which was coordinated by Forbidden Stories and spans 14 media organisations including Le Monde, Haaretz, El Confidencial, Die Zeit, the Guardian, and OCCRP. The inquiry builds on a multiyear investigation by Moroccan journalist Hicham Mansouri, with technical support from Amnesty International's Security Lab. The Guardian published its findings on July 16, 2026.

Safir's testimony is corroborated by the leaked Pegasus project dataset, forensically analysed by Amnesty International's Security Lab. The convergence of an insider account with technical forensic evidence gives the disclosure particular weight: previous reporting on Morocco's suspected Pegasus use relied heavily on digital forensics and target selection data, without confirmation from anyone inside the intelligence apparatus.

According to Safir, NSO Group representatives gave a demonstration of Pegasus to high-ranking Moroccan intelligence officers in 2017 at a villa in Rabat nicknamed "the FSSYS villa," after FSSYS Maroc, the Moroccan branch of UAE-based surveillance intermediary al-Fahad. During the demonstration, NSO representatives infected test phones and remotely activated cameras, microphones, and accessed data and messages. Safir suggested that Pegasus was a gift from the UAE to Morocco, establishing a procurement pathway through Emirati intermediaries rather than a direct bilateral purchase.

Pegasus, manufactured by Israel-based NSO Group, allows its operator to access emails, text messages, and photographs on a target's mobile phone. It can also remotely activate a phone's recorder and camera, turning the device into a covert listening and surveillance tool. NSO Group has long maintained that Pegasus is sold only to governments for tracking criminals and terrorists and has claimed the spyware "leaves no traces whatsoever."

Morocco's deployment extended well beyond Pegasus alone. According to Le Monde, Moroccan intelligence also employed keyloggers installed via USB sticks, pre-installed spyware on phones sold to targets, wiretapping, and hidden cameras as part of its broader surveillance operations. No use of Pegasus by Morocco was detected after autumn 2021.

Morocco has consistently denied using Pegasus to target critics at home or abroad. The government officially characterised media reports about its use of the spyware as "false reports" in a statement carried by Asharq Al-Awsat in July 2021. In response to Pegasus allegations, Morocco launched an aggressive defamation lawsuit campaign across European courts and denounced EU actions related to the spyware claims as "unjust."

The denial strategy now faces a direct challenge from insider testimony. Where previous investigations, including Citizen Lab's 2018 mapping of Pegasus operations across 45 countries, identified Morocco among at least six states with significant Pegasus operations previously linked to abusive use alongside Saudi Arabia, Safir's account provides the first acknowledged operational confirmation from within the intelligence service that conducted the surveillance.

Amnesty International had previously documented individual cases. In June 2020, the organisation revealed that Moroccan journalist and human rights defender Omar Radi was targeted with network injection attacks using NSO Group's tools. Amnesty's Security Lab continued to uncover new instances of Pegasus targeting in Morocco-Western Sahara in the year preceding July 2022, alongside similar findings in Poland.

The investigation's structure mirrors the original 2021 Pegasus Project consortium model, pooling cross-border reporting resources to surface what no single newsroom could independently verify. The addition of an insider whistleblower to the forensic dataset shifts the evidentiary foundation from circumstantial pattern-matching to direct operational testimony, a distinction that matters in European courts where Morocco's defamation suits are still active and where intelligence activities by foreign states against EU officials remain legally and diplomatically contentious.

The targeting of French politicians and Spanish cabinet ministers raises questions that extend beyond press freedom and human rights into the domain of interstate intelligence operations against allied governments. Morocco's relationships with France and Spain, both complex and periodically strained over migration, counterterrorism cooperation, and the Western Sahara question, now carry an additional layer of confirmed digital espionage. The Spanish police officers on the target list suggest intelligence interest extended beyond senior political figures to operational security and law enforcement personnel.

For NSO Group, the disclosure adds another layer of scrutiny to a company already facing litigation, US export restrictions, and mounting regulatory pressure in multiple jurisdictions. The claim that Pegasus was channelled to Morocco through a UAE-based intermediary rather than sold directly complicates the company's stated framework of government-only sales and end-use verification.