Morocco Identified as Pegasus User 'Morgan,' Targeting 200-Plus Spanish Numbers
Updated
Updated · The Guardian · Jul 16
Morocco Identified as Pegasus User 'Morgan,' Targeting 200-Plus Spanish Numbers
3 articles · Updated · The Guardian · Jul 16
Summary
Former NSO employees and a former Moroccan intelligence officer helped identify Morocco as the Pegasus end-user codenamed “Morgan,” tying Rabat’s security services to years of covert phone targeting.
2017 records and whistleblower testimony indicate Morocco’s DGST adopted Pegasus after an NSO demonstration in Rabat, then used the spyware against journalists, human rights defenders and foreign officials when cheaper tools failed.
More than 200 Spanish mobile numbers were selected, and material reviewed by the consortium links a Morocco-assigned attacker account to the targeting of Spanish ministers Margarita Robles and Fernando Grande-Marlaska during a 2021 diplomatic crisis.
Leaked records also suggest Moroccan services targeted Guardia Civil officers visiting Morocco for counterterrorism cooperation, a move one senior Spanish official called “a betrayal.”
The investigation found no evidence of Pegasus use by Morocco after late 2021, after NSO was blacklisted by the US and Israel reportedly curbed cyber exports to Morocco and the UAE.
Pegasus surveillance in Morocco ended in 2021. What more powerful, secret spyware has taken its place?
Morocco spied on Spain's prime minister. Why are the two nations still allies in the fight against terror?
50,000 Targets: How Pegasus Spyware Fueled the Morocco-Spain Crisis and Exposed Europe’s Surveillance Vulnerabilities
Overview
This report uncovers how Morocco, through its intelligence agency DGST, became a key user of Pegasus spyware, following a history of deploying advanced surveillance tools like the RCS system acquired via FSSYS Morocco. Investigations revealed that Morocco’s use of Pegasus fit a broader pattern of digital espionage, notably targeting Spanish officials during a period of diplomatic crisis. The report traces the technical and political pathways of these surveillance activities, highlighting the escalation of tensions, the impact on international relations, and the urgent need for stronger safeguards and accountability in the face of evolving cyber threats.