Moroccan Intelligence Insider Reveals Widespread Use of Pegasus Spyware

A rare insider account is offering an unusually detailed look inside one of the world's most secretive uses of commercial spyware, after a former member of Morocco's domestic intelligence service came forward with evidence of the technology's widespread deployment.

The Whistleblower's Account

A former member of Morocco's domestic intelligence service has helped provide an unprecedented look into how the country's internal security services deployed Pegasus spyware, according to reporting on the disclosure. Insider testimony of this kind is genuinely rare in intelligence and surveillance reporting, since Pegasus deployment by government agencies typically leaves few direct human sources willing to speak, making a former insider's account an unusually significant addition to the broader public understanding of how the tool has actually been used.

The Timeline And Scope Suggested

The whistleblower's account suggests deployment beginning in 2017, targeting both domestic and foreign individuals, a scope that extends beyond narrowly defined counter-terrorism or criminal investigation use into broader surveillance of political, civil society or foreign policy-related targets. A multi-year deployment history targeting both domestic and international figures suggests a sustained, institutionalized surveillance program rather than isolated, one-off uses of the spyware for specific, narrow investigations.

Why Pegasus Specifically Draws This Level Of Scrutiny

Pegasus, developed by Israeli firm NSO Group, has become the most closely scrutinized commercial spyware tool globally, given its documented use by multiple governments against journalists, human rights activists, political opponents and diplomats, uses that go well beyond the counter-terrorism and serious crime investigation purposes the tool's makers say it is licensed for. Morocco has faced previous allegations of Pegasus misuse in past investigative reporting, meaning this insider account adds direct, firsthand corroboration to concerns that had previously relied primarily on technical forensic evidence rather than testimony from someone inside the system.

The Difference Insider Testimony Makes

Technical evidence showing a phone was infected with Pegasus can prove a specific individual was targeted, but it generally cannot reveal the internal decision-making, targeting criteria or institutional scale behind a surveillance program the way direct insider testimony can. That distinction is exactly why this whistleblower's account matters beyond simply confirming what forensic researchers had already suspected, offering a rare window into the human and institutional processes behind Pegasus deployment decisions.

What Comes Next

Morocco's government will face renewed pressure to respond to these specific allegations, whether through denial, investigation, or continued silence, the same range of responses governments accused of Pegasus misuse have typically deployed in similar past cases. International human rights organizations and press freedom advocates are likely to use this insider account as further evidence in their ongoing push for stronger international regulation of commercial spyware sales and deployment, given how directly firsthand testimony like this one undercuts government denials that have relied on the difficulty of definitively proving internal surveillance decisions.

NSO Group itself may also face renewed scrutiny over its licensing and oversight practices, since revelations of this kind repeatedly raise questions about whether the company's stated safeguards against misuse by government clients are being meaningfully enforced in practice.