A Former Moroccan Spy Confirms What Rabat Spent Years Denying

A former officer of Morocco’s domestic intelligence service has confirmed, from inside the agency itself, that the kingdom is a customer of NSO Group’s Pegasus spyware. The account goes further than the 2021 leak that first put Rabat in the global spotlight, describing keyloggers, rigged phones, wiretaps and hidden cameras deployed against journalists and political targets.

Morocco spent years calling those 2021 allegations fabricated and sued the reporters who made them. The new testimony, delivered by a source known only as Safir and published by the French newspaper Le Monde, does not leave much room for that denial to stand.

A Former Spy Breaks a Decade of Silence

Safir spent ten years inside the DGST, Morocco’s powerful domestic intelligence service, before deciding to speak. Le Monde journalists Martin Untersinger and Damien Leloup, who broke the account in the paper’s Pixels technology section Thursday, say revealing his identity would put him at serious risk.

Safir first reached out to Hicham Mansouri, a Moroccan investigative journalist living in exile. Mansouri spent years digging into the claims before bringing them to Forbidden Stories, a Paris-based nonprofit built to continue the work of journalists who have been silenced.

Every authoritarian regime sees danger everywhere.

Mansouri told Forbidden Stories in 2021, describing how Morocco’s security services treat critical reporting as a threat. He cofounded the Moroccan Association of Investigative Journalists and has kept reporting on Moroccan affairs from abroad since fleeing the country in 2016.

The new reporting draws on Safir’s testimony, previously unseen documents from judicial proceedings and Moroccan authorities, and accounts from several other whistleblowers, gathered by a 15-newsroom consortium led by Le Monde and coordinated by Forbidden Stories with technical support from Amnesty International’s Security Lab, the rights group’s digital forensics unit.

What Is the DGST, and What Tools Does It Use?

The DGST is the Moroccan agency Safir says he served, tasked with watching threats inside the country’s own borders. Its toolkit, according to his account and the documents reviewed by the consortium, reaches well past Pegasus into low-tech methods that are just as invasive: physical devices planted on a target rather than beamed in from afar.

The scale of Morocco’s Pegasus use alone was already striking. Forbidden Stories previously found that 10,000 numbers were selected over two years by the NSO client believed to be Morocco’s government, a volume that dwarfed most other countries on the original leaked list.

Safir’s account adds detail on how a target actually gets hit once flagged. The table below lays out what the whistleblower and the reviewed documents describe.

None of these methods need a foreign vendor’s license. That is part of why Safir’s testimony matters: it points to a domestic capability that would survive even if Morocco’s access to Pegasus were cut off tomorrow.

Rabat’s Years-Long Wall of Denial

When the original Pegasus Project published in July 2021, reporters and Amnesty International identified eleven suspected government clients of NSO, including Morocco, Bahrain and Hungary. Rabat’s response was total rejection.

Foreign Minister Nasser Bourita told Jeune Afrique it was “important to shed light on the facts, far from controversy and slander,” and accused parts of the Pegasus consortium of hostility toward the kingdom. NSO Group issued its own statement, titled “Enough is Enough,” insisting the leaked numbers had nothing to do with its client list.

Morocco did not stop at statements. The government sued Amnesty International and Forbidden Stories for defamation within days, then added Le Monde, Mediapart and other French outlets to the case. Years of litigation followed, with Rabat’s lawyers calling the affair a manufactured attack on the country’s reputation rather than opening any public inquiry of its own.

The Journalists Marked as Targets

The Guardian counted 38 Moroccan journalists on the original leaked list, one of the highest tallies of any country in the 2021 investigation. Separately, Forbidden Stories found that 35 journalists across four countries were targeted by the client believed to be Rabat’s government, a wider net than Morocco’s borders alone.

Several names recur across years of reporting on Morocco’s surveillance campaign.

• Omar Radi – an investigative journalist whose phone was hit with repeated network injection attacks before he was convicted on rape and espionage charges he denies, in a case his supporters call retaliation for his reporting.
• Hicham Mansouri – the exiled journalist who first received Safir’s outreach and helped verify his account for Forbidden Stories.
• Maati Monjib – a historian and pro-democracy activist targeted through fake text messages designed to install Pegasus on his phone.
• Abdessadak El Bouchattaoui – a human rights lawyer who defended Rif protesters before serving his own prison sentence and fleeing to France.
• Aminatou Haidar – a Sahrawi rights defender and Right Livelihood Award laureate whose phones carried Pegasus infections across several years.

Each was named in Amnesty International or Forbidden Stories reporting well before Safir came forward. His testimony is the first to place a Moroccan intelligence insider behind the pattern, rather than only the forensic traces left on victims’ phones.

A Paper Trail That Runs Back to 2019

1. 2019: Amnesty International reveals that Maati Monjib and Abdessadak El Bouchattaoui were targeted with malicious links built to install Pegasus.
2. 2020: A forensic review finds Omar Radi’s iPhone hit with network injection attacks, months after NSO Group had pledged reforms.
3. July 2021: The Pegasus Project publishes its leaked list of targets; Morocco denies the findings and sues the reporting nonprofits for defamation.
4. August 2021: Algeria severs diplomatic relations with Morocco, citing alleged Pegasus targeting of more than 6,000 Algerian phone numbers among its grievances.
5. 2022: Amnesty confirms fresh Pegasus infections on the phones of Sahrawi activist Aminatou Haidar, with traces dating as recently as November 2021.
6. 2023: Six Moroccan activists join a class action lawsuit against NSO Group in a California federal court.
7. 2026: Safir comes forward, and the 15-newsroom consortium led by Le Monde publishes his account of a surveillance arsenal beyond Pegasus.

Where Morocco and Its Critics Still Disagree

• Amnesty International and Forbidden Stories say forensic analysis, now paired with an insider’s testimony, proves systemic and unlawful spyware use against civil society.
• The Moroccan government has denied every allegation since 2021 and pursued defamation cases against the reporting consortium instead of opening its own investigation.
• Morocco-aligned commentary, including analysis carried by The North Africa Post, argues the forensic methods used by Amnesty and Citizen Lab are unreliable and accuses the NGOs of a hostile agenda against the kingdom.

Court Cases and International Pressure Are Still Building

The California lawsuit is still moving through the courts after the six Moroccan activists joined the WhatsApp case against NSO Group in 2023. A ruling against the company could open the door to similar claims from the journalists named in Safir’s account.

Pressure has been building outside the courtroom too. Sahrawi rights defender Ghalia Abdallah Djimi told the United Nations Human Rights Council last year that Moroccan authorities exploit surveillance technology to silence critics, part of a wider push for an independent international inquiry.

Morocco’s defamation suits against Amnesty International and Forbidden Stories have not produced the evidence Rabat’s lawyers promised would clear the kingdom’s name. Freedom House has separately documented a pattern of Moroccan authorities pursuing critics even after they leave the country, which raises the stakes for Safir wherever he has taken refuge.

None of that has stopped him from talking. He still meets contacts in public, but carefully. At a café, he asks for his coffee in a disposable cup, so there is nothing left behind with his fingerprints on it.

Frequently Asked Questions

What Is the DGST?

The DGST is described in the investigation as Morocco’s powerful domestic intelligence service, the agency where Safir says he worked for a decade before fleeing to speak out. Its mandate covers surveillance of journalists, activists and others the state considers a threat, according to his testimony and the judicial documents reviewed by the consortium.

What Is Pegasus Spyware?

Pegasus is built by NSO Group, an Israeli company. Any sale abroad needs sign-off from Israel’s Ministry of Defense, which treats the software as a controlled military export, unlike the physical, low-tech tools Safir describes inside the DGST’s own toolkit.

Did Morocco Ever Admit to Buying Pegasus?

No. Rabat has never confirmed a contract. Its lawyers filed defamation cases against the reporting nonprofits instead, while French prosecutors opened a separate espionage investigation the same month, a case tracked continuously since 2021 by the Council of Europe.

Is Safir the Only Whistleblower Involved?

No. The consortium says its reporting also draws on accounts from several other unnamed whistleblowers inside Morocco’s security services, alongside documents from judicial proceedings, giving reporters more than one thread to check Safir’s account against.

What Risks Does Safir Face for Speaking Out?

Le Monde has withheld his age, his current country of refuge, any description of his physical appearance and any recording of his voice. Reporters involved in the project describe the risks he faces as immense, given Morocco’s history of pursuing critics who leave the country.