Morocco’s Pegasus trail widens: whistleblowers allege years of spyware targeting at home and abroad

A whistleblower linked to Morocco’s domestic intelligence service has alleged that the kingdom used commercial spyware—including NSO Group’s Pegasus—against a broad set of domestic and foreign targets starting at least in 2017. The Guardian reports that the insider provided an unprecedented look into how internal security services deployed hacking tools, framing the claims as evidence of widespread, systematic use rather than isolated incidents. A separate Le Monde piece describes the ongoing judicial investigation around “Projet Pegasus,” noting that two former NSO Group officials have been placed under assisted witness status. Le Monde also contrasts earlier French political promises to shed full light on Pegasus-related spying with the slow pace of judicial and diplomatic follow-through. Strategically, the cluster points to how North African intelligence services can operationalize global surveillance ecosystems to shape political outcomes, suppress dissent, and manage external relationships. Morocco is portrayed as having built a “repressive arsenal” beyond Pegasus, including covert installation methods and surveillance capabilities aimed at journalists and political targets, which raises the stakes for regional human-rights compliance and diplomatic trust. The involvement of NSO Group ties the story to a wider geopolitical contest over cyber-sovereignty, export controls, and accountability for surveillance vendors. France’s role—referenced through the Elysée’s 2021 pledge—adds a European dimension: if investigations stall, it can weaken deterrence, complicate cooperation on cyber defense, and intensify scrutiny of intelligence partnerships. Market and economic implications are likely to concentrate in cybersecurity, legal-services, and compliance risk pricing rather than in direct commodity flows. Pegasus and similar spyware programs signal elevated demand for forensic tooling, mobile security monitoring, and incident-response services, while also increasing potential liabilities for vendors and downstream buyers. For investors, the risk is less about immediate revenue swings and more about regulatory and litigation overhang for surveillance technology suppliers, plus reputational discounting for firms tied to human-rights controversies. In the short term, the most visible “market” effect may be volatility in European and Israeli cyber-surveillance sentiment, alongside higher insurance and compliance costs for governments and contractors exposed to spyware allegations. What to watch next is whether the judicial process in France accelerates and whether assisted-witness testimony yields new documentary evidence or named targets. Key indicators include any expansion of the “Projet Pegasus” case scope, new requests for mutual legal assistance, and concrete outcomes from diplomatic engagement referenced as ongoing in Le Monde. On the operational side, look for additional disclosures about deployment methods—such as USB-based installation claims and pre-installed spyware on sold phones—because they can trigger faster regulatory action and technical remediation guidance. Escalation would be signaled by cross-border subpoenas, public naming of additional officials or targets, or renewed export-control debates; de-escalation would hinge on verifiable forensic findings, transparent court milestones, and clearer vendor accountability mechanisms.

Geopolitical Implications

• 01

  Reinforces the strategic value of commercial spyware for intelligence services, increasing pressure for cyber-sovereignty and tighter export-control regimes.

• 02

  Potentially strains European-Maghreb intelligence cooperation if accountability and transparency lag, especially where human-rights allegations are central.

• 03

  Highlights the role of vendor accountability (NSO Group) in shaping diplomatic leverage and future procurement decisions.

• 04

  Could accelerate cross-border legal cooperation and mutual legal assistance requests tied to surveillance evidence.

Key Signals

• —Any court filings or testimony that name additional targets, operators, or procurement channels inside Morocco.
• —Technical indicators from forensic reports (e.g., Pegasus infection chains) that corroborate USB installation and pre-install claims.
• —Whether France expands the scope of “Projet Pegasus” beyond the previously referenced French ministers.
• —New EU/Member-State regulatory actions or export-control debates targeting spyware vendors and resellers.