IC Operations & Tradecraft — 2026-07-18

Former Morocco DGST Officer Reveals Decade of Pegasus Surveillance Against Journalists, Activists, and Spanish Officials

BLUFMorocco's intermediary-based procurement model for Pegasus, now exposed but easily replicated, poses a standing counterintelligence threat to any Western service conducting training exchanges with Rabat.

A former DGST officer using the pseudonym Safir has provided a Forbidden Stories-led consortium, including OCCRP and Amnesty International's Security Lab, with a decade-long account of Morocco's use of NSO Group's Pegasus spyware, corroborated by leaked documents, targeting records, and internal training material 12. Safir said the DGST first saw a Pegasus demonstration at a Rabat villa in 2017, deployed it against journalists including Omar Radi and rights defenders such as Maati Monjib and Aminatou Haidar after exhausting cheaper tools like pre-infected phones and monitored internet cafes, and that a private intermediary shipped NSO-configured servers to DGST data centers to avoid a direct paper trail 123. The consortium's leaked database shows more than 200 Spanish mobile numbers selected for targeting, including Defence Minister Margarita Robles and Interior Minister Fernando Grande-Marlaska 3. A separate Forbidden Stories report says Moroccan intelligence targeted Guardia Civil officer Alberto Aguilera, whose number was selected five times starting on March 8, 2019, and that Safir described monitoring of Guardia Civil personnel who had traveled to Morocco to train DGST staff 4. Reporters found no evidence of Pegasus deployment by the DGST after late 2021 3.

Analysis
A former officer's testimony, corroborated by leaked documents and reported jointly by Forbidden Stories, OCCRP, and Amnesty's Security Lab, indicates DGST built a durable procurement structure rather than a one-off surveillance program: a private intermediary shipped NSO-configured servers directly to Moroccan data centers specifically to insulate Rabat from a state-to-state paper trail, a template that could let Morocco or successor clients resume covert targeting without repeating the exposure that produced this reporting. The operation also monitored Guardia Civil trainers inside Morocco, not just Moroccan dissidents, and this pressures Madrid to reassess safeguards for personnel training foreign services. The consortium sourcing, while convergent, comes from a single coordinated investigative cluster rather than independent confirmation, and Safir's account may overstate DGST's institutional culpability relative to the intermediary company that actually operated the NSO relationship.

4 sources

Morocco Denied Using Pegasus. Documents and Insider Accounts Tell a Different Story - Forbidden Stories
Moroccan Government Used Powerful Israeli Pegasus Spyware, Former Intelligence Officer Says - OCCRP
Moroccan whistleblower reveals how Rabat used Israel Pegasus spyware for surveillance - Middle East Eye
Moroccan intelligence is believed to have spied on Spanish agents who were training them - Forbidden Stories