The Ongoing Pegasus Scandal: Unraveling Allegations Against Morocco
The Pegasus scandal has taken a significant turn in Spain, as new revelations emerge regarding Morocco's alleged involvement in cyber-espionage activities targeting Spanish officials. Recent reports from Spanish media have intensified scrutiny on the Moroccan services, particularly concerning the hacking of high-profile individuals such as Spanish Prime Minister Pedro Sánchez and Defense Minister Margarita Robles, in addition to various other Spanish and European figures. This situation first surfaced publicly in 2022 when the Spanish government disclosed that Pedro Sánchez's phone had been compromised by the Pegasus spyware. Judicial documents released at that time confirmed two instances of infection on Sánchez's device, occurring on May 19 and May 31, 2021. The first infection was notably timed just two days after a significant migration crisis erupted at the Ceuta border, when thousands crossed from Morocco into Spain. This coincidental timing raised immediate questions about the identity of the perpetrator behind the attack. Spanish media previously highlighted that international investigations into Pegasus had already pointed to Morocco as a suspected user of this spyware against numerous notable individuals, including journalists, activists, and political figures.
International Investigations and Emerging Evidence
By May 2022, La Vanguardia reported that an international inquiry revealed that a client of NSO Group, the Israeli company behind Pegasus, had selected over 200 Spanish phones as potential targets, with Morocco emerging as a key suspect. The Catalan daily emphasized that Rabat had access to Pegasus for several years, with documented attacks on Moroccan activists identified as early as 2017. This coincided with the rapid normalization of relations between Morocco and Israel beginning in 2020. The situation became more sensitive when investigations also indicated that French officials had been targeted, with EL PAÍS noting that some operations aimed at French personalities, including President Emmanuel Macron, were suspected to involve Moroccan security services. The central question then became whether the same infrastructures, methods, or operators were employed against Spanish officials.
Despite these serious allegations, Spanish judicial authorities have not reached a definitive conclusion regarding Morocco's involvement. The investigation has faced numerous challenges, particularly the lack of cooperation from key players necessary to establish accountability. In January 2026, EL PAÍS revealed that Judge José Luis Calama of the National Audience believed that Israeli cooperation had significantly hampered investigations into the espionage of multiple Spanish government members using Pegasus. However, the case gained renewed momentum following the transmission of information from France to Spanish authorities. In 2024, the National Audience reopened the inquiry into the espionage targeting Pedro Sánchez and several ministers after receiving new French data, which highlighted technical similarities between the attacks in Spain and those against French figures. This technical correlation, while not definitive proof of the perpetrator, has heightened investigators' interest in the possibility of a common operator or surveillance environment.
The European Parliament has already deemed the Moroccan connection plausible, and the hypothesis of Moroccan involvement extends beyond mere Spanish political accusations. EL PAÍS reported in 2023 that the European mission investigating the Pegasus scandal considered it "plausible" that Morocco was behind the espionage targeting Pedro Sánchez. Nevertheless, this assessment should be distinguished from definitive judicial evidence and is part of a broader array of indicators that include the timeline of attacks, victim profiles, historical precedents attributed to Moroccan services, and technical similarities noted among various operations. Morocco has consistently denied these accusations and has sought legal recourse in Spain to absolve itself of involvement in some Pegasus-related proceedings. This scandal has become inextricably linked to the diplomatic crisis with Rabat, further complicated by Spain's dramatic shift in policy towards Morocco regarding Western Sahara. In March 2022, Pedro Sánchez made a historic change in Spain's stance, endorsing Morocco’s autonomy proposal for the region. Shortly thereafter, Sánchez visited Rabat to usher in a new phase of bilateral relations. Simultaneously, the investigation revealed that his phone had been compromised in May 2021, during a major crisis between Madrid and Rabat. This series of events has fueled speculation about the potential existence of an unseen power dynamic influencing the diplomatic crisis. Some Spanish political figures even suggested the possibility of blackmail, an allegation that resurfaced in September 2026 when Alberto Núñez Feijóo, the leader of the People’s Party, claimed that Pedro Sánchez might be "under blackmail" from Rabat due to information obtained through the espionage of his phone. This remains a political accusation rather than a judicial conclusion.
Recent developments, however, have added new layers to the case. According to EL PAÍS, Morocco has been facing a significant cyber-attack campaign attributed to the group Jabaroot, which is potentially linked to Algeria, since 2025. The hackers claim to possess information related to Moroccan intelligence services and have made accusations concerning the espionage of Pedro Sánchez's phone with Pegasus. Rabat disputes the allegations and the origins of the published data. Such claims must be approached with caution, as hacker group statements do not constitute judicial proof. Nonetheless, they indicate that Pegasus remains central to the ongoing informational warfare among various actors regarding Morocco. The Spanish case remains open, with the accumulated evidence over the years forming a substantial web of suspicion surrounding the Moroccan angle, suggesting direct responsibility from Rabat’s services in the infection of Pedro Sánchez's phone. One thing is now clear: the Pegasus scandal transcends the realm of mere spyware allegations. It has evolved into a matter of national security, digital sovereignty, and international relations, where the boundaries between intelligence, diplomacy, and cyber warfare are increasingly difficult to delineate.
As reported by lexpressiondz.com.
