Amnesty Report Documents Morocco's Sustained Spyware Campaign Against Civil Society

Amnesty International has released a new report showing how, despite official denials, Moroccan authorities used surveillance spyware against civil society between 2017 and 2021, and possibly continued to use it later.

The rights watchdog’s report, titled “We start with the verdict” : Inside Morocco’s surveillance machine, details how the government deployed Israeli firm NSO Group’s Pegasus spyware to target civil society figures both domestically and abroad in what Amnesty described as “unlawful surveillance attacks.”

“The report presents extensive technical and forensic evidence confirming the DGST acquisition of Pegasus, confirms that civil society members were the primary target of Morocco from the very beginning of their Pegasus use in 2017,” Donncha Ó Cearbhaill, leader of the Security Lab told OCCRP.

According to the findings, the government's deployment of Pegasus evolved in tandem with the technological development in the spyware. Amnesty documented the use of sophisticated attack vectors, ranging from “one-click” phishing links requiring user interaction to advanced “zero-click” exploits capable of compromising devices without any action from the target.

While Pegasus represents the most technically advanced system documented in the report, Amnesty emphasized that it is merely one of the “digital tool[s] among many in Morocco’s repressive surveillance ecosystem.”

The report traces the government's use of digital espionage tools over two decades, citing the mass surveillance system Eagle, acquired in the early 2010s from French firm Amesys; the Remote Control System (RCS) spyware from Italian vendor Hacking Team, used in 2012 against journalists with the citizen media group Mamfakinch; and FinSpy software developed by the Anglo-German company Gamma Group and FinFisher.

As early as 2012, “Morocco was among the first countries where activists and journalists were found to be targeted with advanced spyware tools,” Amnesty said.

The Moroccan government has not responded to OCCRP’s request for .

Evidence suggests that national security agencies purchased these spyware systems even earlier. In 2015, emails included in a major leak from Hacking Team revealed that two Moroccan

security agencies, the internal intelligence service, the Direction Générale de la Surveillance du Territoire (DGST) and the National Defence Secrets Committee (CSDN) had contracted with Hacking Team since at least 2009. The records also show that the DGST was licensed to infect up to 2,000 devices, with support for Windows, Mac and mobile devices.

An OCCRP investigation published in July in collaboration with the Paris-based nonprofit Forbidden Stories revealed new evidence of Morocco’s secret service’s use of surveillance technology, particularly how the internal intelligence service DGST were using Pegasus and other surveillance tools to spy on activists.

A whistleblower who worked inside Morocco’s secret services added new evidence to the allegation that the government was behind the spying on a journalist, shedding light on the inner workings of state-backed surveillance operations and how the tool was used. His account was corroborated by other sources with knowledge of Moroccan intelligence operations, and documents.

According to the whistleblower, Moroccan intelligence agents utilized a private intermediary firm to contract with NSO Group, the Israeli cyber-intelligence company that created Pegasus. This arrangement was designed to shield the state from leaving a paper trail directly linking it to NSO Group or the spyware.

The latest evidence stems from a multi-year investigation led by Moroccan journalist Hicham Mansouri, whose own device was infected with Pegasus. Mansouri partnered with Forbidden Stories, the newsroom dedicated to continuing the work of threatened, silenced, or imprisoned journalists. Forbidden Stories organized a media collaboration titled "Pegasus Project: Inside the Moroccan Spying Machine," bringing together 39 journalists across 14 media outlets.

Amnesty’s report builds on this and the 2021 Pegasus Project , a global investigation involving 17 media organizations and coordinated by Forbidden Stories. The landmark reporting revealed that the spyware had been systematically deployed worldwide against journalists, human rights activists, and politicians.

Despite the increasing evidence presented in these publications, the Moroccan government responded to the July reporting with a familiar pattern of denials. Pro-government Moroccan media outlets launched a campaign of disinformation, dismissing the reports as based on “an unverifiable anonymous source, flimsy documentary evidence, and a persistent confusion between technical detection and state attribution.”

The pro-government website Al Barlamane similarly dismissed the investigation as incitement seeking to undermine relations between Morocco and France, stating that the report was published at a time when relations between Rabat and Paris were “undergoing a period of restructuring following successive signs of rapprochement.”

A third website, Le 360 , again labelled the evidence as “very fragile,” claiming that the provided evidence was “aggregated under the same biased and politically assumed narrative.”

Corroborating data published in the July investigation, Amnesty’s latest report presents technical evidence that an NSO Group VPN server was deployed within Morocco’s DGST IP range in September 2017. This timeline aligns with earlier testimony and technical leaks from the Pegasus Project that showed DGST officers testing the system on their own phone numbers that same month.

Furthermore, the report says that the Apple iCloud accounts used to target Spanish ministers were the same as those used to target journalist Hicham Mansouri and Claude Mangin, the partner of Naama Asfari, a Sahraoui activist who is imprisoned in Morocco. Since NSO assigns accounts exclusively to single customers, Morocco is the only plausible operator, said Amnesty.

“The forensic evidence and analysis [presented in the report] allows for the high-confidence attribution of Pegasus attacks against Hicham Mansouri and other French-based civil society, the targeting of French and Spanish politicians, and Western Sahara activists as all have been carried out by Morocco's Pegasus system,” said Amnesty's Ó Cearbhaill.