Morocco behind Pegasus spyware attacks on Spanish ministers, Amnesty International concludes

Investigation links same iMessage account deployed against Moroccan and Sahrawi targets in France to 2021 hacks of Spanish defence and interior chiefs

Amnesty International has attributed the 2021 Pegasus spyware attacks on the official mobile phones of Spain's Defence Minister, Margarita Robles, and Interior Minister, Fernando Grande-Marlaska, to Moroccan intelligence services. A report published on Thursday identifies the Directorate General for Territorial Surveillance (DGST), Morocco's domestic intelligence agency, as the NSO Group client operating the system. It contends that the identical attack infrastructure assigned to Rabat was deployed against activists, journalists, and politicians in France, as well as to compromise the handsets of the two Spanish ministers. The human rights organisation concluded that the findings provide 'strong material evidence that Morocco was ultimately responsible' for an extensive cross-border Pegasus campaign targeting critical journalists, activists, lawyers, and politicians.

This marks the most definitive conclusion reached by Amnesty to date regarding one of the foremost unresolved questions of Spain's Pegasus affair: who was behind the massive data breach from Spanish cabinet ministers' phones. The document states that independent investigations conducted in France and Spain established that 'the attacker accounts assigned to Morocco's Pegasus system' matched those used to compromise the devices of senior Spanish officials during the diplomatic standoff with Rabat in May and June 2021.

The central piece of technical evidence points to a specific address: [email protected]. That iMessage account, linked by investigators to the attack infrastructure of the Moroccan Pegasus client, was identified in the 2021 infections of French activist Claude Mangin and exiled Moroccan journalist Hicham Mansouri. The same identifier, Amnesty notes, appears in Spanish judicial records as the Apple account deployed in the zero-click exploits that breached the mobile phones of the Spanish defence and interior ministers.

The report places significant weight on this match because NSO Group configured dedicated, segregated infrastructure for each client. A specialised team within the firm, known as 'White Glove Services', expressly registered unique email addresses, Apple IDs, domains, and servers for each operator. According to Amnesty, 'NSO Group sets up distinct and isolated infrastructure for each customer'—a safeguard designed specifically to prevent attacks from being traced back to those who commissioned them.

That architecture has now served as a digital fingerprint. 'Amnesty International has never observed a particular attacker account or infection domain being used by more than one customer,' the document states. Consequently, the recurring presence of an identical account across multiple devices enables investigators to cluster the attacks and attribute them to a single operator.

The French inquiry provides secondary corroboration. France's national cybersecurity agency, ANSSI, inspected targeted handsets in France and pinpointed the same cluster of Apple accounts used to deploy Pegasus. This intelligence was subsequently transferred to Spain via a European Investigation Order. 'Amnesty International's forensic evidence and independent findings by French authorities show that many individuals selected in the Pegasus Project records were ultimately infected using a shared pool of iMessage accounts,' the report asserts.

The identical account used in 2021 against Mangin and Mansouri, [email protected], 'was also identified in a Spanish court document as the Apple account used in the 2021 Pegasus zero-click attacks that compromised the phones of the Spanish Interior Minister and the Minister of Defence,' Amnesty specified.

However, the document notes a caveat regarding Prime Minister Pedro Sánchez. The Spanish prime minister's handset was also breached using Pegasus during the same period, between May and June 2021, yet Spanish judicial filings do not identify the iMessage account used to compromise it. The report therefore stops short of establishing the direct forensic link for Sánchez that it does for Robles and Marlaska.

The breaches occurred during the most volatile phase in Madrid-Rabat relations in decades. In April 2021, Spain had admitted Polisario Front leader Brahim Ghali for medical treatment. On 17 and 18 May, thousands of migrants crossed into the Spanish enclave of Ceuta from Morocco. Mr Sánchez's phone was infected on 19 and 31 May, resulting in the extraction of 2.6 gigabytes and 130 megabytes of data respectively. Ms Robles was targeted in June, with nine megabytes exfiltrated, whilst Mr Grande-Marlaska suffered two breaches that same month, during one of which more than six gigabytes of data were stolen.

Amnesty explicitly distinguishes between being listed as a target and actual infection. The Pegasus Project database contains thousands of telephone numbers entered by clients as prospective targets, but 'only forensic analysis of target devices can confirm beyond doubt that a number selected for targeting with Pegasus was infected'. In the Spanish case, the organisation maintains that the evidential bridge is provided by forensic analysis, the chronological overlap between target selection and infections, and above all, the reuse of attack accounts specific to the Moroccan client.

The 126-page report, entitled 'We Start with the Verdict: Inside Morocco's Surveillance Machine', charts the deployment of Pegasus in the country since 2017. Amnesty identifies 'with a high degree of confidence' the DGST as 'the end user responsible for the use of Pegasus' against Moroccan and Sahrawi civil society, as well as for surveillance operations conducted outside Morocco and Western Sahara.

The investigation cross-references internal NSO Group materials disclosed during litigation brought by WhatsApp and Meta against the Israeli firm, leaked surveillance records, forensic audits, and testimony from a former DGST operative identified by the pseudonym Safir. 'We never start with Pegasus. It is the monster weapon,' the former agent claimed, describing the spyware as the final tier in a much wider surveillance apparatus.

Re-examining the original Pegasus Project records, Amnesty identified nearly 13,000 unique phone numbers selected as prospective targets by the Moroccan client, identified as the DGST. It represented the largest customer in that database by volume of unique targets. Between September and December 2017 alone, researchers linked 103 Moroccan numbers to specific individuals. Of those, 65 belonged to civil society: 34 human rights defenders, 22 journalists or media workers, five lawyers, and four academics.

'The numbers of prominent human rights defenders and journalists were among the first entered into the Pegasus system,' Amnesty noted, concluding that such records indicate the surveillance of civil society figures 'was a core and not incidental purpose' of the DGST's acquisition of the spyware.

The operation quickly crossed international borders. The first foreign number traced to the Moroccan system emerged in April 2018, followed by French and Spanish handsets. The first Spanish number selected by the DGST, according to the report, was logged on 11 May 2018 and belonged to the Sahrawi activist Aminatou Haidar, whose device Amnesty subsequently confirmed had been infected by Morocco.

In March 2019, Spanish journalist Ignacio Cembrero also appeared in the logs, his phone selected 25 times over the subsequent two months. Amnesty documents a campaign that encompassed Moroccan journalists living in Europe, lawyers involved in Western Sahara affairs, activists, diplomats, and French politicians. 'Target selection led to Pegasus infections,' the document states after cross-checking records against subsequent digital forensics on numerous handsets.

The lead now expanded upon by Amnesty had previously surfaced during the Spanish inquiry. It was revealed in May 2024 that data remitted from France had identified the [email protected] account in the attacks on Robles and Grande-Marlaska, as well as those targeting Mangin, Mansouri, Sahrawi diplomat Oubi Buchraya Bachir, and Philippe Bouyssou, mayor of Ivry-sur-Seine and Sahrawi activist. Analysis conducted at the time by Spain's National Cryptologic Centre (CCN) noted 'multitudes' of parallels, yet the judicial investigation remained unable to identify a specific perpetrator.

Spain's High Court, the Audiencia Nacional, provisionally shelved the investigation for a second time on 22 January. Judge José Luis Calama stated that the 'frustration of the execution' of letters rogatory sent to Israel, where NSO Group is based, 'prevents investigation into attributing authorship of the investigated acts to any specific individual'. The case had previously been closed in July 2023 due to a lack of Israeli cooperation, before being reopened in April 2024 following the arrival of new evidence from France.