Moroccan intelligence whistleblower tells how spyware, including Pegasus, was deployed against journalists and officials

A former member of Morocco’s domestic intelligence service says Moroccan state-linked units used hacking software, including Pegasus spyware, against a broad range of targets starting in 2017, according to a report published July 16 by The Guardian. The account, presented as a whistleblower disclosure, describes how internal security services carried out surveillance using intrusive digital tools and provides what the outlet calls an unprecedented view into the practice inside Morocco.

The disclosure alleges that the hacking tools were used to target journalists and human rights defenders, along with prominent foreign officials. The report also says the alleged targets included French politicians and Spanish cabinet ministers, extending beyond Morocco’s domestic sphere and into European political institutions.

The whistleblower account further describes use of Pegasus-linked capabilities against police and other figures, indicating the surveillance program may have intersected with law-enforcement and internal security priorities, not only external political monitoring. The Guardian describes the revelations as covering how Morocco’s internal intelligence service allegedly deployed spyware as part of its operational activities.

According to the Guardian, the former insider has been involved in helping to provide the insight, framed as a shift from previously public allegations toward more detailed internal disclosure. The report characterizes the information as describing not only the existence of hacking capability, but its use against named categories of individuals across countries and institutions.

The timeline described by the whistleblower begins in 2017 and, as presented in the report, suggests the program’s use was not limited to a one-time episode. Instead, it portrays the deployment as widespread enough to reach multiple segments of society, including press and civil society actors, political figures, and police.

In the wake of such disclosures, questions typically shift to whether Moroccan authorities conducted the alleged operations under lawful domestic procedures, whether any oversight mechanisms were applied, and what remedies could exist for individuals whose devices were reportedly targeted. The Guardian report sets out the whistleblower’s claims, but it does not, in the supplied account, indicate specific court findings or official conclusions about the allegations.

For governments and institutions affected, the practical impact can include renewed scrutiny of cybersecurity protections, legal standards for surveillance, and diplomatic engagement over cross-border digital intrusion allegations. The revelations, if substantiated through independent verification or legal proceedings, could also deepen pressure on Moroccan institutions to explain the scope of hacking programs and the safeguards governing intelligence activities.