TheChek News Flow

In late 2013, a young Israeli using the name Shalev Holy landed in Panama. According to the paperwork, he was there for tourism, and the address recorded was that of the Israeli Embassy in Panama City. The passport was a diplomatic passport.

But the young man's real last name was Hulio, not Holy. According to an investigation by a consortium of journalists, a year before his visit, NSO Group, the spyware company Hulio co-founded, sold Panama a revolutionary product called Pegasus, which was little known at the time.

Hulio denies that he had a diplomatic passport and calls the claim that he used the name Holy "false." Eight years after the Panama visit, the international Pegasus Project investigation revealed that the NSO spyware had been sold to regimes around the world and was used by many of them to surveil journalists, politicians and human rights activists. Among the victims were ministers in France and Spain.

Pegasus grants customers full access to the infected phone; remotely, they can read all the files and messages in encrypted apps. Covertly, they can also activate the camera and microphone.

Now, a follow-up investigation in the wake of yearslong work by the Moroccan journalist Hicham Mansouri reveals further details on the use of the spyware around the world.

Panama, it turns out, was one of the first countries to buy Pegasus; the follow-up investigation reveals screenshots from a live spyware interface and Panama's user license. It confirms that Morocco hacked into the phones of senior French and Spanish officials, and reveals a clutch of Israeli spy companies that armed the king's intelligence service, years before Israel and Morocco established diplomatic relations under the Abraham Accords.

The investigation was coordinated by the Paris-based organization Forbidden Stories, which continues the work of threatened journalists, and 39 journalists from 14 media outlets including Israel's Haaretz and Shomrim.

The investigation, also backed by technical support from Amnesty International's Security Lab, is based on the testimony of a former officer in Morocco's domestic security service, the DGST, as well as leaked documents, digital forensics, the French government's investigation file, and interviews with sources including former NSO employees and Western officials.

Hulio, who says he left NSO years ago, rejected the investigation's central claims and strongly denied the passport account that anchors this article. "Your allegations concerning a diplomatic passport and my purported role as a representative of the State of Israel are entirely false and categorically denied." That example alone, he wrote, "illustrates how an elaborate narrative can be built on a false premise."

The king's spy apparatus

The investigation reveals that Morocco was an NSO client at least since 2017, when it received the code name "Morgan" at the company. But the kingdom wasn't content with Pegasus spyware and bought additional Israeli surveillance systems. The DGST set up an extensive spy apparatus that brought in Israeli technicians who installed the systems. Also on board was Maroc Telecom; its network was used to infect the targets' phones with spyware.

Among the surveillance targets were the journalist and corruption investigator Omar Radi and the historian and activist Maati Monjib, on whose devices traces of Pegasus were found.

To accompany Pegasus, starting in 2017 Morocco operated a system from the Israeli company Circles that enables the location of a device anywhere in the world by exploiting weaknesses in the international communications system. Morocco's use of the software was first exposed by the Toronto-based Citizen Lab institute, and the new investigation shows that the DGST has used it.

Circles is considered the first Israeli cyber intelligence company. It was founded by Tal Dilian, a former commander of Military Intelligence's tech unit; in 2014 it was acquired and merged with NSO's parent company. Circles' technology and Pegasus were probably sold to Morocco in a single package: one tool to locate the phone and one to break into it.

A year before it procured Pegasus, Morocco was already in talks to buy surveillance systems from the Israeli company Verint. In internal company documents from 2016 obtained by Haaretz, Morocco appears under the code name "Magazine." The documents record negotiations over deals worth $18 million for the purchase of the cellphone location system Skylock and of a location-and-intelligence platform. The documents also reveal contacts for the sale of spyware that Verint had developed for cellphones, called EPI.

Cognyte, the cyber division spun off by Verint in 2021, was banned from Meta's Facebook and Instagram that year because of surveillance that Cognyte had done for Morocco. In 2022, Cognyte was dropped from the portfolio of Norway's sovereign wealth fund over an "unacceptable risk" of contributing to rights violations.

The new investigation has also found that Morocco used phone-cracking tools from the Israeli company Cellebrite; such tools make it possible to physically break into phones in the client's possession and extract the information stored there. In 2019, the organization Privacy International reported that Cellebrite had offered Morocco a service for scanning the phones of asylum seekers at the border. A DGST officer told the authors of the new investigation that Morocco also used Cellebrite to spy on human rights activists.

Morocco was also interested in a system called Nighthawk from the Israeli company Interionet, which met with DGST agents. Documents and interviews show that the company presented a system that enables the takeover of security cameras and so-called network edge devices, and allows the client to watch the broadcast live.

It's unclear if Morocco actually bought the system. In 2022, Haaretz exposed the company Toka, which sells camera-hacking tools. It now turns out that similar technology was exported from Israel to nondemocratic states even earlier.

In 2023, the company QuaDream also sought to sell Morocco offensive spyware that, like Pegasus, makes it possible to covertly break into a phone without any action by the victim ("zero-click"). But this purchase, made after the Abraham Accords were signed in 2020, was blocked by Israel's Defense Ministry, in part because Morocco had used Pegasus against France and Spain. The refusal hastened QuaDream's collapse.

From Rabat to Paris – and back

In the new investigation, the materials obtained from France, Spain and Morocco show that Morocco used Pegasus to spy on its neighbors to the north. Government documents reveal how France and Spain investigated the break-in to the phones of senior ministers, including the clash with the Israeli government that followed.

In 2021, the Pegasus Project exposed a list of phone numbers that a Moroccan Pegasus user had selected as potential targets for hacking. The French investigation file that reached Haaretz shows that the country's national cyber authority found signs of attempts to break into the devices of ministers, legislators and social activists – some on the very same day these targets were selected. According to the documents, the French found a successful hack of a device belonging to the deputy climate minister, Emmanuelle Wargon, one of seven such cases.

The list of targets also included a phone number linked to President Emmanuel Macron and the number of France's then-defense minister, Florence Parly. While the documents showed no signs of hacking regarding the first case, they did regarding Parly. The cyber authority was unable to provide many confirmations of break-ins, and any confirmations did not mention Pegasus by name.

After publication of the initial allegations, Macron spoke with then-Prime Minister Naftali Bennett and demanded that his defense minister, Benny Gantz, come to Paris for a meeting with Parly. Gantz told her that Defense Ministry officials had visited NSO's offices and Israel was "examining the matter with the utmost seriousness." Parly said that Gantz was "in a very defensive posture." Ever since, officials from both Jerusalem and NSO have said they have found no proof that Morocco has used Israeli technology to spy on French officials.

According to reports in France, Macron also raised the matter with Morocco's King Mohammed VI. "I have proof; either you're lying or you don't know what's happening in your country," he reportedly told the king. A memo written by the French foreign-intelligence service, which has not previously been reported, confirms that Pegasus servers and domain names were used to designate phones "located in France."

According to the memo, it is "highly probable" that NSO – and perhaps the Israeli government – knows which phones were designated. The memo also reveals that Pegasus spyware was also sold to Indonesia and Malaysia, Muslim countries with no official diplomatic ties to Israel.

As has been revealed in The New Yorker, the Spanish intelligence agency, the CNI, used Pegasus to spy on officials and activists in the Catalonia region. But through Project Pegasus, the Spanish discovered that Morocco was using the same tools to spy on them. Prosecutors in Madrid determined that the phones of Prime Minister Pedro Sánchez and two of his ministers, including the defense minister, had been infected.

Classified CNI documents, which the ministers who suffered break-ins were shown, named Fouad Ali El Himma, an adviser close to the king of Morocco, as the person who ordered the surveillance. This happened as tensions over Spain's immigration crisis peaked.

In 2023, Spain shelved the investigation into its own targeting, declaring that Israel refused to cooperate and made it difficult for NSO to reveal details about its operations in courts abroad, as has happened in other proceedings against the company. The most famous example is the lawsuit brought by WhatsApp's owner, Meta, in which Israel seized documents from the company to prevent their submission in court.

NSO founders Hulio and Omri Lavie are no longer with the company, which was bought by an American ownership group. Early this year, a French investigating judge questioned Hulio and Lavie about the spyware's features and what they knew about Morocco's use of it. The two declined to answer questions about the product their former company had sold to Morocco many years earlier.

On the hacking of senior French officials, Hulio said that, as far as he knew, Israel had found no proof that senior French officials had been hacked, and that this finding had been conveyed to France. "Neither Macron nor any other political figure was a target of Pegasus." About Morocco, Hulio told the judge only: "I know that Morocco denied purchasing it."

Despite the affair, Spain and France smoothed things over with Morocco, and this week, French Prime Minister Sébastien Lecornu and more than 10 ministers visited the North African country. Lecornu himself has been a target. Spain has since decorated the head of the Moroccan secret service twice; once by the Spanish interior minister, himself a target of a break-in.

In his written statement, Hulio also mentioned the original 2021 Pegasus Project, arguing that many of its main assertions "have been conclusively shown to be factually inaccurate and simply untrue," and that new questions asked are based on assumptions that are "inaccurate, distorted or entirely false."

He rejected any suggestion that declining to answer amounted to agreement, writing that a decision not to respond to questions "built on false or misleading premises cannot reasonably be interpreted as confirmation of those premises." Questions about the company's activities, he added, should be directed to NSO itself.

The NSO Group, the Israeli Defense Ministry and the governments of Morocco, Panama, France and Spain did not respond to a detailed list of questions they received ahead of publication of the investigation.

$8 million from Panama

A decade before the Spain-France-Morocco affair, one of NSO's first deals took shape across the ocean. Government documents obtained by Luis Esquivel, one of the journalists in the consortium, reveal that Panama bought Pegasus spyware in 2012, with a license for 300 infections of Android and BlackBerry devices. The end-user agreement was signed by Gustavo Pérez, the chairman of Panama's National Security Council, while a letter signed by Hulio confirmed receipt of $8 million for the product.

Screenshots not previously published show the spyware's interface from the side of a Pegasus client. The screengrabs from Panama show a system identical to Saifan, an early version of Pegasus that the Israel Police operated and that was previously reported by Haaretz.

Panama's National Security Council, which bought Pegasus, operated under President Ricardo Martinelli, who served from 2009 to 2014. The screenshots show how the spyware's operators penetrated the two leading campaigns in the presidential election that year; only three parties competed. The screengrabs display, for example, email messages of the officials responsible for publishing the election results, and a voter registry.

One screenshot shows that the operators also penetrated the BlackBerry device of Vice President Juan Carlos Varela. In May 2014, Varela was elected president. A week later, according to Hulio's signed letter, NSO identified the last operation of the spyware.

In 2015, an indictment was filed against Martinelli for wiretapping journalists and political rivals. He was extradited from the United States, where he had fled, before a trial in which he was acquitted.

Under his presidency, Panama was one of nine countries that voted at the UN General Assembly in 2012 against recognizing a State of Palestine. This was, perhaps, the first sign of what would later become a habit – a quid pro quo for Benjamin Netanyahu's Israel from countries granted the chance to buy the best of Israel's digital weaponry.