After Pegasus, Spain fears a much more discreet new spyware in Morocco
Spanish intelligence sources suspect that Morocco may have gained access to Graphite, an Israeli spyware capable of infecting a phone without any action by its owner. However, no public evidence confirms its acquisition or use by Rabat.
Fears of new cyberespionage have resurfaced in Spain. Security sources believe that Morocco may have established contacts with Paragon Solutions, the Israeli company that develops Graphite, reports The Objective->https://theobjective.com/espana/2026-09-20/inteligencia-sospecha-marruecos-usando-gemelo-invisible-pegasus/ this Sunday, September 20.
These sources raise the possibility of Moroccan access to the software at the end of 2025 or during 2026. However, they provide no technical, contractual or financial evidence confirming the existence of an agreement.
Nor does Morocco appear among the countries so far identified as users of Graphite. Spanish suspicions seem to be based primarily on the strengthening of military and technological cooperation between Rabat and Israel.
On Bladi.net : Spanish PM and Defense Minister’s Phones Hacked with Pegasus Spyware, Morocco Suspected
The issue remains particularly sensitive in Spain, where the phones of Pedro Sánchez and several ministers were infected with Pegasus in 2021. Madrid denounced “external and illicit” attacks, without ever officially assigning responsibility to Morocco. The Spanish government then carefully avoided directly accusing Rabat.
Graphite directly targets encrypted messaging services
Graphite was developed by Paragon Solutions, an Israeli company founded in 2019. Unlike Pegasus, which was presented as capable of broadly taking control of a phone, Graphite is reportedly designed primarily to access instant messaging applications and their contents.
The software can be installed through a so-called “zero-click” attack, without the target clicking on a link or opening a file. WhatsApp discovered and neutralized an attack of this type before warning, in January 2025, more than 90 people believed to have been targeted.
The Citizen Lab at the University of Toronto identified infrastructure potentially associated with Graphite in Australia, Canada, Cyprus, Denmark, Israel and Singapore. This list is not exhaustive, however: some operators may protect their servers against the tools used to map espionage infrastructure.
On Bladi.net : article 95544
These characteristics explain the concern expressed by the Spanish sources. Software focused on encrypted messaging services and leaving limited traces can make it more difficult to retrospectively identify an attack and its sponsor.
The case directly recalls Pegasus. In 2021, the phones of Pedro Sánchez, Margarita Robles and Fernando Grande-Marlaska were compromised during the diplomatic crisis with Rabat. Morocco had always denied acquiring or using Pegasus and launched legal proceedings against several authors of these accusations.
To date, no Spanish authority has announced discovering Graphite on the phone of a public official. Nor has Morocco been identified by Citizen Lab as a Paragon client. The information published by The Objective therefore reveals persistent concern within Spanish intelligence, but not evidence of a new Moroccan espionage operation.
