Moroccan Intelligence Insider Blows Whistle on Years of Pegasus Spyware Targeting
A former spy describes how Morocco reportedly used phone-hacking software since 2017 to surveil journalists, human rights workers, and foreign politicians, including cabinet ministers in Spain and officials in France.
Key points
- A former member of Morocco's domestic intelligence service has spoken out about the country's alleged use of Pegasus spyware dating back to at least 2017.
- Pegasus, built by the Israel-based NSO Group, can silently access every message, photo and call on a target's phone, and secretly activate its microphone and camera.
- Reported targets include journalists, human rights defenders, French politicians, and Spanish cabinet ministers and police officers.
- The account, first reported by The Guardian, offers rare insider detail on how a government customer of NSO Group allegedly ran these operations.
A former Moroccan intelligence officer has given what researchers are calling an unusually detailed account of how his country's domestic spy agency allegedly used Pegasus spyware, software that turns a smartphone into a remote listening device, to monitor enemies at home and allies abroad.
Pegasus is made by NSO Group, an Israeli company that sells the tool exclusively to government clients. Once installed, with no action required from the target, the operator can read emails, see photos and listen to calls, and activate the microphone and camera in real time. It's essentially a skeleton key to everything on your phone.
According to the whistleblower, Morocco began deploying the software around 2017. Targets reportedly included local journalists and human rights defenders inside Morocco, French politicians, and Spanish cabinet ministers alongside Spanish police officers. Targeting a neighbour's security forces sits in a different category of seriousness from domestic surveillance alone.
Why should ordinary people care about this?
Most of us aren't targets of nation-state spyware. But this case confirms that advanced phone-hacking tools, once marketed as weapons against terrorists and serious criminals, were turned on politicians, lawyers and activists. That widens the circle of who should think carefully about digital security.
If you communicate with anyone in a sensitive profession, a refugee advocate or a politician's staffer, there's a small but real chance your messages could sit on a phone that is itself a target.
The operation fits a pattern that threat-intelligence analysts track closely. NSO Group's customer base and targeting behaviour have been documented by Citizen Lab and Amnesty International's Security Lab, two groups that study commercial spyware by examining infected devices. Attribution here sits at high confidence based on multiple independent technical investigations, not on this insider account alone. We covered a related case on 3 July 2026, when forensic analysis confirmed repeated Pegasus infections on an EU lawmaker's phone while he sat on the European Parliament's own spyware inquiry. Morocco has previously denied using Pegasus against the targets named in those earlier reports.
Should you worry?
For high-risk individuals, the practical steps are limited but worth knowing. Keep your phone's operating system updated: spyware like Pegasus often exploits software flaws that updates later patch. Apple's Lockdown Mode, a setting that blocks many advanced attack routes, exists precisely for people who believe they're a person of interest to a government. Regular restarts can sometimes interrupt certain implants on Android devices.
For everyone else, the point is simpler: surveillance tools marketed as targeted get used far more broadly than advertised. That's what this account, combined with years of forensic research, keeps showing.
