Allied Intelligence — 2026-10-02

Amnesty Report Documents Morocco DGST Sustained Pegasus Spyware Campaign Against Civil Society

BLUFAmnesty's technical and human-source evidence linking DGST to Pegasus targeting of civil society narrows Rabat's deniability and reopens diplomatic exposure with Madrid and Paris.

Amnesty International's Security Lab published a report on October 1 identifying Morocco's domestic intelligence service, the DGST, as the operator of NSO Group's Pegasus spyware against activists and journalists between 2017 and 2021 12. Amnesty said it matched 103 numbers entered into the system from September to December 2017 to individuals: 65 civil society members, including 34 human rights defenders and 22 journalists, 25 officials or politicians, and five diplomats 23. The report draws on a former DGST employee identified as Safir, who described pre-infected phones sold through shops, infected internet cafés, and microphones hidden in journalist Omar Radi's light fixtures 23. OCCRP reported that Amnesty linked iCloud accounts used against Spanish ministers to those used on journalist Hicham Mansouri, and that an NSO VPN server sat in DGST address space in September 2017 4. Morocco did not respond to Amnesty or OCCRP and has denied using spyware 234.

Analysis
Rabat faces an attribution problem that denial alone is unlikely to contain, because civil society, not criminals or militants, headed a Pegasus target list that was operational by autumn 2017. Moroccan officials will very likely keep denying involvement and offer no substantive rebuttal through the end of October. Amnesty's forensic infrastructure analysis and quantified 2017 target list now supplement what had been a single-whistleblower basis for the claim. The iCloud links between accounts used against Spanish ministers and journalist Hicham Mansouri extend the exposure to Madrid and Paris. Confidence is high because leaked targeting records, the insider account, and technical forensics converge, though OCCRP and Al Jazeera add no independent verification of Amnesty's attribution. Rabat's supporters argue the report conflates detection with state attribution, rests on one anonymous insider, and may be timed to Rabat-Paris strain. Spain and France must decide whether to open inquiries or press Rabat, and export regulators whether to restrict NSO sales to Morocco.

4 sources

"We start with the verdict": Inside Morocco's Surveillance Machine - Amnesty International Security Lab
Whistleblower reveals how Morocco used a web of surveillance to silence journalists and activists - Amnesty International
Moroccan intelligence uses surveillance to 'silence' journalists: Amnesty - Al Jazeera
Amnesty Report Documents Morocco's Sustained Spyware Campaign Against Civil Society - OCCRP