MOROCCO’S government has spent years insisting, in venue after venue, that it has never purchased or used Pegasus, the notorious phone-hacking tool built by Israel’s NSO Group. That denial has now been directly contradicted from inside the kingdom’s own security establishment. According to OCCRP, a former Moroccan intelligence officer has come forward with a detailed account of how the country’s domestic spy agency acquired Pegasus, tested it, and turned it against journalists, activists and, eventually, foreign officials – testimony that several independent sources and leaked documents have corroborated.
OCCRP reports that the whistleblower, using the pseudonym “Safir” to protect his safety, spent almost a decade inside Morocco’s Direction Générale de la Surveillance du Territoire (DGST), the internal security service that answers to the interior ministry. His account forms the spine of a new investigation coordinated by Forbidden Stories, the Paris-based press-freedom newsroom, in partnership with Moroccan journalist Hicham Mansouri – himself previously imprisoned in Morocco – and with technical support from Amnesty International’s Security Lab. The consortium, comprising 14 outlets including Le Monde, Haaretz, El Confidencial, Die Zeit and The Guardian, has billed the project as “Inside the Moroccan Spying Machine,” building on the landmark 2021 Pegasus Project investigation.
A Villa, a Demonstration, and a Decision
According to OCCRP, Pegasus was formally introduced to Moroccan intelligence in 2017, when representatives of NSO Group travelled to a villa in Rabat to give senior DGST officers and technicians a live demonstration of the software’s capabilities – reportedly hacking the phones of DGST officers who volunteered to be targeted so their superiors could see the tool in action. Weeks later, OCCRP notes, the DGST began deploying Pegasus operationally, first against Moroccan journalists and human rights defenders, before widening its net to include foreign diplomats, security officials and civil society figures well beyond the kingdom’s borders.
OCCRP reports that Safir was blunt about the agency’s approach to the expensive tool: Pegasus was never the DGST’s opening move. Cheaper, less sophisticated methods – trailing suspects, monitoring internet cafés, even persuading shopkeepers to sell dissidents mobile phones pre-loaded with malware – came first. Pegasus, in Safir’s words as relayed by the investigation, was reserved for when those methods failed and a target proved unusually disciplined about their digital hygiene. “It’s the monster’s weapon,” he is quoted as saying.
A Paper Trail Designed Not to Exist
Central to Safir’s account, according to OCCRP, is how Morocco structured the deal to avoid a direct, traceable link between the Moroccan state and NSO Group. OCCRP reports that the DGST procured Pegasus through a private intermediary company, which shipped NSO-configured servers into Morocco and installed them inside DGST data centres, giving Moroccan agents their own operating dashboard for the spyware. A second former intelligence source independently corroborated this arrangement to the consortium, though it remains unclear whether the intermediary played any operational role once the system was deployed against targets.
Reporters did not simply take Safir’s word for it. OCCRP reports that journalists cross-referenced phone numbers he provided against a leaked database of numbers targeted with Pegasus in 2017 and 2018 – the same trove of roughly 50,000 numbers at the heart of the original 2021 Pegasus Project – and confirmed that the specific DGST officers Safir named had indeed had their own phones targeted during the software’s rollout.
From Domestic Dissidents to Foreign Officials
The investigation’s reach extends well beyond Morocco’s own critics. According to OCCRP and its partners, more than 200 Spanish mobile numbers were selected for Pegasus targeting by an operator believed to be Morocco, among them Aminatou Haidar, the prominent Western Sahara human rights activist, and journalist Ignacio Cembrero. Senior Spanish officials – including then-defence minister Margarita Robles and then-interior minister Fernando Grande-Marlaska – were also named as targets, alongside Spanish Civil Guard officers who had travelled to Morocco to share counter-terrorism expertise with their Moroccan counterparts.
Perhaps the most granular detail to emerge concerns the pursuit of Moroccan investigative journalist Omar Radi, whose iPhone the DGST reportedly could not crack through Pegasus alone. Internal records seen by the consortium – filed under the case name “Op S6_Edge” – describe Radi as unusually cautious, switching off his phone before meetings with sources and hanging up on calls the moment he suspected he was being monitored. Frustrated agents ultimately seized Radi in person outside a Casablanca bar in an operation Radi himself has described as feeling like being trapped inside “one of Hollywood’s worst” films.
The Gulf Money Trail
OCCRP reports that Safir also offered an explanation for how a cash-strapped agency could afford one of the world’s most expensive surveillance tools: the United Arab Emirates. “Millions for the Emiratis, that’s nothing,” Safir is quoted as saying. “The Emirates bought it and redistributed it to friendly services. You could say it’s like Netflix: a friend pays for the subscription, and the others use their account.” If accurate, the claim would place Morocco inside a wider web of Gulf-financed surveillance capacity shared among allied security services – a pattern press-freedom researchers have long suspected but rarely heard described so plainly from the inside.
Rabat’s Silence, and What It Means for the Continent
Moroccan authorities did not respond to requests for comment on the findings, OCCRP notes, leaving Safir’s testimony – and the corroborating leaked data – unanswered by the state it implicates. NSO Group likewise did not respond to a request for comment. The silence is itself instructive: for years, Rabat’s position has been one of categorical denial, most notably after the original 2021 revelations named Morocco as a suspected Pegasus operator targeting figures ranging from French President Emmanuel Macron’s inner circle to Algerian officials.
For African newsrooms and press-freedom advocates, this investigation lands as more than a Morocco story. It is a reminder that commercial spyware, once dismissed by governments as a tool reserved for counter-terrorism, has become a routine instrument for monitoring the continent’s own journalists, human rights defenders and political dissidents – often procured through opaque intermediaries precisely to insulate governments from accountability. The pattern Safir describes, of plausible deniability engineered by design, is one that press-freedom bodies across Africa, including those The African Mirror works alongside, have flagged repeatedly as among the hardest obstacles to holding surveillance states to account. As this newsroom has reported extensively on accountability failures within South Africa’s own security and intelligence apparatus, the Moroccan disclosures underscore a continental truth: without whistleblowers willing to risk their safety, and an independent forensic capacity of the kind Amnesty’s Security Lab provided here, state surveillance overreach routinely evades scrutiny altogether.
