An Amnesty International report indicates that Morocco used Pegasus in Spain

"Morocco expanded the use of Pegasus outside its borders against targets such as Moroccan activists, journalists, lawyers, military personnel, diplomats and political leaders throughout Europe, with particular interest in France and Spain." That is the conclusion reached in Amnesty International's new report.

Throughout 126 pages, the analysts describe Morocco's way of spying and tracking its objectives and interests, and Spain's presence appears throughout the report. Because the Israeli Pegasus software with which the mobile phones of several ministers were infected has a great role in the analysis.

As they conclude, the first Spanish telephone number chosen by the General Directorate of Territorial Surveillance (DGST), the Moroccan intelligence service, was a number associated with the Sahrawi human rights defender Aminatou Haidar, whose terminal - as later confirmed by a forensic analysis by Amnesty International - had been infected by Morocco with Pegasus on May 11, 2018.

Thus, as they explain, at the end of that year they also increased the number of Spanish telephones that they added Pegasus to. Their activity, as they explain, was easier thanks to the "zero-click" policy, whereby they no longer needed the owner of the phone to click on a link to install the software.

As they detail, in 2019 incursions increased in selected numbers and sensitive profiles for the regime. «On February 25, the number of a Spanish activist who chaired an association supporting the independence of the Sahara was selected as a target. On March 5, the target was a Moroccan journalist living in Spain, Hussein Majdoubi. That same day the telephone number of the Spanish journalist Ignacio Cembrero was also selected...»

They later explain that in a court document, WhatsApp identified 69 Moroccan, 39 Algerian, 21 Spanish and 7 French phone numbers that were targeted during that same period.

The report does not dare to conclude that the theft of information from Pedro Sánchez's phone with Pegasus has Morocco behind it, but it does do so with the phones of the ministers of Defense, Agriculture and the Interior. Amnesty International even provides a graphic in which it identifies the iMessage link with which the software would have been installed on the devices. The address to which it is attributed is [email protected].

"Amnesty International has never observed that a particular attacking account or infection domain was used by more than one client," the document explains. Hence, they conclude that the repetition of the same account on several phones allows, according to their researchers, the attacks to be grouped and attributed to the same operator.