#Pegasus #Spain #Morocco #France #Emmanuel #Macron #espionage
Four years after the first revelations, a French president potentially targeted, a Spanish prime minister spied on, and Morocco still suspected. Spain turns to Eurojust to pressure France and Morocco.
Four years after the Pegasus scandal erupted, the shadow of the spyware continues to loom over diplomatic relations between Rabat, Paris, and Madrid. Despite mounting technical evidence and judicial cross-references, no official charges have yet been brought against Morocco. But pressure is building: Spain has referred the matter to Eurojust, the European Union Agency for Criminal Justice Cooperation, in an attempt to break what many call a « geopolitical deadlock. »
In February 2026, Germany’s Federal Court of Justice definitively dismissed Morocco’s lawsuits against the media outlets Zeit Online and Süddeutsche Zeitung. Weeks earlier, Spanish judge José Luis Calama, faced with prolonged silence from the French judiciary, decided to seize Eurojust. It is a strong signal illustrating the latent tensions between European allies, caught between the demand for truth and diplomatic realities.
European leaders in the crosshairs
The scandal broke in the summer of 2021, when the Forbidden Stories consortium revealed that Moroccan services were among the presumed main clients of the NSO Group, the Israeli company behind Pegasus. This spyware, one of the most intrusive in the world, can infect a phone without any user action.
Among the thousands of preselected numbers are several top-ranking figures. In France, Emmanuel Macron’s personal number, used since his 2017 presidential campaign, was reportedly targeted in 2019. The names of then-Prime Minister Édouard Philippe, fourteen government members, and several close associates of the president also appear. Florence Parly, then Defence Minister, had her phone infected. Five other ministers – Blanquer, Gourault, Denormandie, Wargon, and Lecornu – had their targeting confirmed.
In Spain, the shock was equally violent. Pedro Sánchez, three of his ministers (Interior, Defence, Agriculture), as well as the National Cryptologic Centre, were targeted. The data exfiltrations coincided with the Ceuta migration crisis in May 2021, at the height of tensions between Madrid and Rabat.
A shared technical infrastructure and persistent questions
Investigators uncovered a troubling technical consistency: the same digital infrastructure was reportedly used to target Spanish and French officials simultaneously. Among the French targets linked to this system were a pro-Sahrawi activist, a Polisario Front diplomat, and an exiled Moroccan journalist. This geographic pattern suggests a strategic logic centred on Western Sahara, at the heart of Moroccan priorities.
According to sources close to the case, the French judiciary now considers Moroccan involvement credible. But for now, that conviction has not led to any public charges. Rabat has consistently denied all allegations, denouncing « unfounded accusations. »
The Moroccan paradox: opponents… and the king’s entourage
Before becoming a European diplomatic crisis, Pegasus was first used, according to several NGOs, to monitor independent journalists and Moroccan activists. Omar Radi, Taoufik Bouachrine, Ali Amar, and Hamid El Mahdaoui were infected. Radi was subsequently sentenced to six years in prison in a trial widely criticised by human rights organisations.
More surprisingly still, numbers close to King Mohammed VI – chamberlain, personal physician, bodyguard, and even the sovereign himself – appeared among the preselected targets. This reveals the extent of a surveillance apparatus where the boundaries between internal and external threats blur.
French caution raises questions
One of the most sensitive angles remains Paris’s attitude. Despite opening a judicial investigation in July 2021 and appointing an investigating judge in June 2022, no official charges against Morocco have been filed. French authorities also delayed responding to Spanish judicial cooperation requests, remaining silent for months. This blockage led Madrid to refer the matter to Eurojust in late 2025.
For NGOs and investigative media, this restraint is explained by realpolitik considerations: security cooperation, migration management, France’s position on Western Sahara, and the normalisation of relations with Rabat initiated in 2023. This caution raises questions about the ability of European democracies to investigate strategic partners.
Morocco’s legal setbacks
Morocco has launched numerous defamation lawsuits against media outlets – without success. In France, the Paris Court of Appeal confirmed the inadmissibility of proceedings against Le Monde, Mediapart, Radio France, and Amnesty International. In Germany, the Federal Court of Justice ruled in February 2026 that a foreign state cannot invoke the protection of honour to sue media outlets.
The affair has also had major regional repercussions, contributing to the diplomatic rupture between Algeria and Morocco in August 2021 – a rupture that remains in force.
Pegasus: a test for European democracies
As of April 2026, the Pegasus affair remains in a grey zone. Technical evidence is accumulating, investigations are converging, Eurojust has been seized – but no charges have yet been brought.
The scandal continues to weigh on Mohammed VI, whose services are regularly implicated, on Emmanuel Macron, targeted by a partner country, and on Pedro Sánchez, caught between judicial demands and diplomatic imperatives.
The Pegasus affair has now become a test for European democracies: a test of their ability to shed light on cybersurveillance operations involving allied states. The response from Eurojust and any shift in the French position will be closely watched. Because behind the algorithms and remote infections, the question of judicial sovereignty vis-à-vis raison d’État is squarely posed.
With Afrik.com
