Image Credentials: Image Title: BREACH OF TRUST: Morocco Linked to 2021 Pegasus Cyberattack on Spanish PM Sánchez. Source: (sora.openai) Date: February 2026. Attribution: This image was created using AI-generated imagery (sora.openai) and does not depict a real-world scene.
By Open Chronicle Staff | Thursday, February 12, 2026
MADRID – New findings have reignited one of Europe’s most contentious diplomatic scandals, confirming that Moroccan intelligence services were behind the 2021 infection of Spanish Prime Minister Pedro Sánchez’s mobile phone with the Pegasus spyware.
The breach, which occurred during a period of extreme geopolitical tension, coincided exactly with Sánchez’s high-profile visit to the Spanish enclave of Ceuta in May 2021. According to judicial sources and technical reports reviewed, the infiltration allowed for the extraction of significant volumes of data, estimated at over 2.6 gigabytes, from the Prime Minister’s personal device.
A Crisis on Two Fronts
In May 2021, Spain and Morocco were embroiled in a fierce diplomatic standoff. The crisis began after Spain allowed Brahim Ghali, the leader of the Polisario Front, to receive medical treatment in a Spanish hospital. In apparent retaliation, Moroccan authorities loosened border controls, leading to more than 10,000 migrants crossing into Ceuta in a single 48-hour window.
It was during this state of emergency, while Sánchez was physically present in the enclave to assert Spanish sovereignty, that his phone was successfully compromised. Forensic experts from Spain’s National Cryptologic Center (CCN) had previously identified the “external and illicit” nature of the attack, but the formal attribution to Rabat has long been the “open secret” haunting Madrid’s foreign policy.
The “Pegasus Effect” on Diplomacy
The fallout of the hack has led many analysts to question the sudden shift in Spain’s stance on the Western Sahara conflict. In March 2022, less than a year after the Pegasus infection, Sánchez made a historic U-turn, abandoning Spain’s traditional neutrality to support Morocco’s autonomy plan for the territory.
Opposition leaders and privacy advocates have suggested that the stolen data may have been used as “digital blackmail” to coerce the Spanish government into alignment with Moroccan interests. While the Spanish government has officially attributed the policy shift to “a new era of bilateral cooperation,” the timing of the cyber-espionage remains a focal point for critics.
Judicial Breakthrough
The case, which had been shelved by the Spanish National Court due to a lack of cooperation from Israeli authorities (the creators of Pegasus, NSO Group), was reopened in 2024 following new evidence provided by French investigators. The French data corroborated markers found on Sánchez’s phone with those found on the devices of French officials, who were also targeted by Moroccan-linked Pegasus operators.
“This was not just a breach of a phone; it was a breach of national security and sovereignty,” said a senior official familiar with the investigation.
As of today, the Moroccan government continues to deny any involvement in the use of Pegasus against foreign leaders. However, the shadow of the 2021 Ceuta crisis and the digital fingerprints left behind suggest a far more complex reality of modern statecraft and surveillance.