IC Technology — 2026-07-20

El Confidencial Investigation Reveals Morocco DGST Attempted to Hack Over 12000 Devices Across 20 Countries Using Pegasus Spyware

BLUFMadrid's sustained refusal to confront Rabat over confirmed espionage against its own security officials exposes a strategic dependency on Moroccan migration and Western Sahara cooperation that effectively neutralizes accountability.

El Confidencial, working with the Forbidden Stories consortium and outlets including Le Monde and The Guardian, reported that Morocco's DGST domestic intelligence service attempted to hack more than 12,000 devices across over 20 countries using Pegasus spyware between 2017 and 2021 1. The investigation documented 768 infection attempts against 250 Spanish phone numbers between May 2018 and June 2019, including five attempts in March 2019 against Guardia Civil colonel Alberto Aguilera, then the force's Catalonia intelligence chief 1. Other identified targets include Dutch journalist and former NRC correspondent Koen Greven 2 and El Confidencial reporter Ignacio Cembrero 1. Morocco has denied using Pegasus and previously sued several European media outlets over similar allegations without success 2. The investigation was built primarily on testimony from a former DGST agent using the pseudonym Safir, working with exiled Moroccan journalist Hicham Mansouri, and separately identified French President Emmanuel Macron, Belgian Prime Minister Charles Michel, and Algerian armed forces chief of staff Said Chengriha among the targets 1.

Analysis
Based on testimony from a single ex-DGST agent and one investigative consortium, without independent forensic corroboration, the disclosure shows Moroccan surveillance of the Spanish state predating and dwarfing the 2022 Sánchez case, reaching a serving Guardia Civil Catalonia intelligence chief through five infection attempts in March 2019 alongside Rif and Polisario activists, indicating Rabat sought insight into Spanish security planning rather than dissident tracking alone. Madrid's decoration of DGST director Hammouchi last November, despite confirmed 2021 prime-ministerial infections, and its choice never to formally protest Morocco or sue NSO Group together indicate migration and Western Sahara cooperation outweigh spyware fallout in Spanish policy calculus. The 12,000-device, 20-country total rests on a leaked targeting list, so actual infections may fall well short of documented attempts.

4 sources

Marruecos amplió el espionaje con Pegasus más allá de Sánchez: 250 móviles españoles en el punto de mira - El Nacional
Morocco allegedly attempted to spy on Dutch journalist - NL Times
Investigación sitúa a Marruecos detrás de cientos de intentos de espionaje con Pegasus contra móviles españoles, saharauis y argelinos - ECSaharaui
Morocco Denied Using Pegasus. Documents and Insider Accounts Tell a Different Story - Forbidden Stories (consortium with El Confidencial, Le Monde, The Guardian, Die Zeit, Der Spiegel, Haaretz, Amnesty International Security Lab)