A DGST Insider Says Pegasus Reached Rabat in a Villa in 2017, and Morocco Has Not Answered

On Thursday 16 July, Forbidden Stories, Amnesty International and 13 media organisations published testimony from a man given the pseudonym “Safir,” described as a near-decade veteran of Morocco’s Direction Générale de la Surveillance du Territoire, on Rabat’s use of Pegasus and other spyware against journalists, human rights defenders and foreign officials. The consortium says his account was corroborated by leaked emails, targeting records, victim testimony, internal training material and data analysed by Amnesty’s Security Lab, and reports that Pegasus was first introduced to Moroccan intelligence in 2017, in a villa in Rabat. The byline is José Bautista, Eloïse Layan, Hicham Mansouri and Guillaume Vénétitay. Omar Radi is named among the targets. Morocco denied comparable allegations in 2021; a Moroccan response inside this window is not established in the material reviewed. France 24’s press review tied the publication date to the French prime minister’s visit to Morocco.

The same day, Amnesty’s Security Lab published what it calls its most complete technical analysis of Pegasus, drawing on previously unpublished NSO Group marketing and engineering material disclosed in the WhatsApp and Meta civil case in a US court, with selected exhibits republished on GitHub. It describes the “Pegasus Anonymizing Transmission Network,” a custom VPN layer used to deliver payloads and route collected data back to the customer’s on-site system so that neither target nor investigator can identify the operator, and says NSO’s “White Services” department creates fresh customer-specific accounts and domains as standard practice, citing exhibit ECF 800-3. Separately, Citizen Lab reported on 3 July that former MEP Stelios Kouloglou was infected in October 2022 and March 2023 while sitting on the European Parliament’s PEGA committee.

Assessment: Three documents, none from this window, all moving as if new — the second recirculation pattern of the day. The Moroccan file rests on one pseudonymous human source plus a documentary record; those are different evidentiary weights and should not be merged into a single confidence level. Amnesty is an advocacy organisation whose forensic work has repeatedly held up, and it is also the plaintiff-adjacent party benefiting from the NSO litigation record it is quoting. What the Kouloglou finding adds is the accountability measure: the parliamentarians investigating spyware were themselves targeted, and nothing followed. Watch for whether Rabat answers at all — silence has been the durable strategy since 2021.