A former spy from Morocco's intelligence service has come forward to say that Morocco secretly used powerful phone spyware called Pegasus to target journalists, activists, French politicians, Spanish ministers, and Spanish police officers from 2017 to 2021.

The whistleblower goes by the pseudonym Safir and worked inside Morocco's domestic intelligence service, the DGST, for almost a decade. Two other former Moroccan intelligence agents helped confirm facts for the investigation, which was coordinated by Forbidden Stories and involved 14 media organisations including Le Monde, Haaretz, El Confidencial, Die Zeit, the Guardian, and OCCRP. The inquiry builds on years of work by Moroccan journalist Hicham Mansouri, with technical help from Amnesty International's Security Lab. The Guardian published the findings on July 16, 2026.

Pegasus is a spyware tool made by an Israeli company called NSO Group. Once it infects a phone, the person operating it can read emails and text messages, view photos, and secretly turn on the phone's camera and microphone. The phone becomes a hidden listening device, and the owner has no idea. NSO Group has long said it only sells Pegasus to governments for tracking criminals and terrorists, and has claimed the spyware "leaves no traces whatsoever."

What makes this disclosure especially strong is that Safir's insider story matches up with a separate set of leaked data, which Amnesty International's Security Lab analysed using forensic methods. Previous reporting on Morocco's suspected Pegasus use relied on that kind of digital evidence alone, without anyone from inside the intelligence service confirming it.

According to Safir, NSO Group representatives gave a live demonstration of Pegasus to senior Moroccan intelligence officers in 2017. It took place at a villa in Morocco's capital, Rabat, nicknamed "the FSSYS villa" after FSSYS Maroc, the Moroccan branch of a UAE-based surveillance middleman called al-Fahad. During the demo, NSO representatives infected test phones and remotely turned on cameras, microphones, and accessed messages and data. Safir suggested that Pegasus was a gift from the UAE to Morocco, delivered through Emirati intermediaries rather than bought directly.

Morocco's surveillance went beyond Pegasus. According to Le Monde, Moroccan intelligence also used keyloggers (hidden programs that record every keystroke) installed through USB drives, pre-installed spyware on phones sold to targets, wiretapping, and hidden cameras. No use of Pegasus by Morocco was detected after autumn 2021.

Morocco has consistently denied using Pegasus to target critics. In July 2021, the government called media reports about its spyware use "false reports" in a statement carried by Asharq Al-Awsat. Morocco also launched defamation lawsuits across European courts and called EU actions related to the spyware claims "unjust."

That denial strategy now faces a direct challenge. Earlier investigations, including Citizen Lab's 2018 study mapping Pegasus operations across 45 countries, had identified Morocco among at least six countries with significant Pegasus operations linked to abusive use, alongside Saudi Arabia. But Safir's account is the first confirmation from inside the intelligence service that actually carried out the surveillance.

Amnesty International had previously documented individual cases. In June 2020, the organisation reported that Moroccan journalist and human rights defender Omar Radi was targeted using NSO Group's tools through a method called a network injection attack, where the attacker intercepts a phone's internet connection to deliver spyware. Amnesty's Security Lab kept finding new instances of Pegasus targeting in Morocco and Western Sahara through the year before July 2022, with similar discoveries in Poland.

The investigation brought together 14 news organisations across borders, the same approach used in the original 2021 Pegasus Project. Adding a whistleblower to the existing forensic data shifts the evidence from indirect patterns to direct testimony from someone who was there.

That matters in European courts, where Morocco's defamation lawsuits are still active. Intelligence operations by foreign governments against EU officials are legally and diplomatically sensitive, and having an insider confirm what was previously only suspected changes the picture.

The broader context here is about more than press freedom. The fact that French politicians and Spanish cabinet ministers were targeted means Morocco was conducting intelligence operations against allied governments. Morocco's relationships with France and Spain are already complicated by disagreements over migration, counterterrorism cooperation, and the status of Western Sahara. The targeting of Spanish police officers suggests the surveillance went beyond top politicians to include rank-and-file law enforcement.

For NSO Group, the news adds pressure on a company already dealing with lawsuits, US export restrictions, and growing regulatory scrutiny in several countries. The claim that Pegasus reached Morocco through a UAE-based intermediary, rather than through a direct sale, raises questions about NSO's promise that it only sells to governments and verifies how its tools are used.