Overview
- Amnesty International published a 126-page report on October 1, 2026 that combines forensic analysis, thousands of leaked records, and on-the-record testimony from a former DGST agent known as 'Safir'.
- The report says the Direction Générale de la Surveillance du Territoire (DGST) used Pegasus and other commercial intrusion tools and that NSO Group staff provided demonstrations and training to DGST officials starting in September 2017.
- Investigators document practical methods for surveillance including selling second-hand phones already infected, infecting internet-café computers, recruiting neighbors as informants, and installing tiny hidden microphones in homes.
- Amnesty shows the program prioritized Sahrawi and Rif activists and extended overseas to target journalists, politicians and activists in Spain and France, and it links the same attack infrastructure to infections of Spanish ministers' phones in 2021.
- Moroccan authorities have repeatedly denied using interception tools and had not answered Amnesty's information requests at publication, and the report has prompted new calls for legal, diplomatic and export-control measures against spyware vendors.