A sweeping international investigation has provided the most detailed account to date of how Morocco’s security apparatus allegedly built an extensive domestic and international surveillance network using Pegasus, the powerful spyware developed by Israeli cyber company NSO Group. The investigation, coordinated by the journalism consortium Forbidden Stories and involving 14 media organizations, including Die Zeit, Le Monde, Haaretz, Der Spiegel and Paper Trail Media, draws on whistleblower testimony, internal documents and forensic analysis to reconstruct what researchers describe as the inner workings of Morocco’s alleged surveillance system.
At the center of the investigation is the testimony of a former member of Morocco’s domestic intelligence service, identified only by the pseudonym “Safir,” who said he participated in multiple surveillance operations before deciding to speak publicly. According to the investigation, Safir described an intelligence system capable of monitoring political opponents, journalists and activists through a combination of physical surveillance, cyber operations, intercepted communications and sophisticated spyware.
One of the principal targets, according to the investigation, was Moroccan investigative journalist Omar Radi. Radi, known for reporting on corruption and land seizures, spent time in prison on espionage and rape charges that human rights organizations have described as fabricated. Now based in Hamburg as a fellow at a foundation supporting politically persecuted individuals, Radi told Die Zeit he took some satisfaction in knowing he had made surveillance more difficult by frequently changing his routines, turning off his phone before meetings and limiting sensitive conversations.
Safir described those efforts as a challenge for intelligence officers. Conventional surveillance, he said, often proved ineffective because Radi constantly altered his movements. According to the whistleblower, authorities ultimately turned to Pegasus after other methods failed.
Technical evidence cited in the investigation indicates Radi’s phone was repeatedly infected with Pegasus between February 2019 and January 2020. Amnesty International’s Security Lab identified forensic traces supporting those infections. Safir alleged that the surveillance extended beyond Radi himself, claiming intelligence officers also monitored members of his family and organized information extracted from his device into categorized contact groups.
The investigation argues that Pegasus became the centerpiece of a much broader surveillance architecture. According to Safir, Moroccan intelligence allegedly had access to nationwide surveillance cameras, including private systems, through Israeli-made software known as Nighthawk. Telephone connection records dating back two years could reportedly be searched on demand, while IMSI catchers were deployed during anti-government demonstrations to identify nearby mobile phones.
Safir also alleged that authorities infected computers in internet cafés frequented by opposition activists and distributed compromised smartphones through retail stores. The investigation includes photographs from 2017 that reportedly show a newly purchased Samsung Galaxy smartphone transmitting covert images back to intelligence services immediately after its owner activated the device. The owner, a social justice protest organizer whose identity is known to Die Zeit, told reporters he only realized years later that his phone had allegedly been compromised after being contacted through the investigation.
According to Safir, intelligence officers also relied on covert recordings to pressure critics. He alleged that hidden cameras installed inside air-conditioning units were used to secretly record intimate encounters involving government critics. The investigation links those claims to the publication of private videos involving a human rights activist in 2020. Safir said another tactic involved temporarily confiscating laptops at airports under routine pretexts before installing surveillance software supplied by the Italian company Hacking Team, which later withdrew from Morocco over human rights concerns.
The investigation traces Pegasus’ arrival in Morocco to 2017, when NSO employees allegedly demonstrated the spyware during several days of presentations inside a villa in Rabat for members of Morocco’s domestic intelligence agency, the DGST. According to Safir and several industry sources cited by Die Zeit, Morocco acquired Pegasus through an intermediary arrangement involving the United Arab Emirates and a company called FSSYS Maroc, allegedly allowing Morocco to obtain Israeli surveillance technology despite the absence of formal diplomatic relations with Israel at the time.
Neither Morocco’s Interior Ministry nor the DGST responded to questions submitted by the reporting consortium. The Israeli Defense Ministry did not clarify whether it had revoked any export authorization after allegations of Pegasus misuse became public. NSO founder Shalev Hulio did not directly address detailed questions about Morocco’s alleged use of Pegasus, telling reporters that many assumptions underlying the questions were inaccurate or distorted.
The investigation also explores the broader diplomatic role of Pegasus. Because exports of Israeli cyber weapons require approval from Israel’s Defense Ministry, several industry insiders interviewed by Die Zeit described Pegasus as an instrument closely connected to Israeli foreign policy. According to those sources, licensing advanced surveillance technology became part of wider regional security relationships involving countries that publicly maintained limited ties with Israel while privately expanding intelligence cooperation.
The reporting further alleges that Moroccan surveillance extended beyond its borders. Previously leaked target lists examined by Forbidden Stories and Amnesty International reportedly included phone numbers associated with European Council President Charles Michel, French President Emmanuel Macron, French investigative journalists, ministers from France and Algeria, and other foreign officials. Earlier reporting in 2021 had already linked alleged Moroccan surveillance to attacks targeting French government figures, allegations Morocco denied.
The revelations also intersect with a lengthy legal dispute involving Die Zeit and other German newspapers. Following the 2021 Pegasus investigation, Morocco filed lawsuits claiming the reports falsely alleged the kingdom had ever used the spyware. According to the investigation, Morocco maintained before German courts that Pegasus had “never been used.” In February 2026, Germany’s Federal Court of Justice dismissed the kingdom’s final appeal, ruling that a foreign state could not pursue personality-rights claims against domestic media organizations.
The investigation revisits NSO’s broader history as Pegasus became one of the world’s most controversial cyber tools. Originally presented by its founders as technology intended to combat terrorism, Pegasus was later linked to surveillance operations targeting journalists, opposition figures, lawyers and activists in multiple countries, including Mexico, Poland, Hungary, Saudi Arabia and the United Arab Emirates. Court records cited in the investigation also show that when questioned in France earlier this year about Pegasus sales to Morocco, Hulio declined to identify customer countries, citing Israeli law, while noting only that Morocco had denied purchasing the software.
Although NSO’s market position has weakened since the original Pegasus disclosures in 2021, the investigation suggests that concerns over commercial spyware remain active. Recent forensic examinations have reportedly uncovered Pegasus traces on the phone of another European politician who had worked on issues related to the spyware. The identity of the party responsible for that infection remains unknown.
For Omar Radi, the investigation documents how years of surveillance continue to shape daily life. He told Die Zeit he still frequently looks over his shoulder in public and changes his mobile phone number every year. Radi also said he considers Safir’s decision to come forward significant after years inside the intelligence system. The investigation concludes with both men connected by the same story from opposite sides of Morocco’s alleged surveillance apparatus—one who says he was watched for years, and another who now says he helped build the system that watched him.
