"We had never encountered anything comparable. NSO attacks stood out for their sophistication. They exploited weaknesses in Android and iOS platforms. Back in 2017 targets needed to tap a link. By 2019 an anonymous call alone proved sufficient: infection occurred in under five seconds," explained Safir*, a former DGST operative. He labeled Pegasus the monster's weapon.

Throughout his DGST tenure Safir visited the villa multiple times. On earlier trips he frequently crossed paths with a striking individual serving as host who facilitated introductions yet skipped the classified sessions. "I encountered Wassim there on several occasions," Safir noted, though Forbidden Stories could not confirm these meetings independently. Wassim F., a Moroccan cybersecurity and telecom expert unaffiliated with the DGST, worked at the time for FSSYS Morocco, the local arm of UAE-based Al Fahad, which lent the villa its nickname.

Israeli software, an Emirati firm and Moroccan intelligence formed an unlikely alliance. Safir's fresh testimony, backed by security sources across Morocco, Europe and the cyber-surveillance sector, reveals a tale the parties have long concealed. Morocco apparently relied heavily on Pegasus, developed by a firm tied to top Israeli officials, with access reportedly arranged through the UAE and FSSYS Maroc, though the consortium could not confirm every detail.

"An intermediary leaves no trace," Safir observed. "Certain deals simply cannot involve intelligence agencies directly."

In 2017 the three-nation arrangement was far from assured. Morocco and the UAE only established ties with Israel late in 2020 via the Abraham Accords. Five years after the first Pegasus Project disclosures, Forbidden Stories and partners expose the mechanics of this discreet spyware partnership, supported by exclusive records showing NSO's close links to the Israeli state.

This amount covered 300 simultaneous targets split evenly between Android and BlackBerry. Additional payment records to NSO appear in statements from the intermediary firm. The scale aligns with roughly 12,000 potential Moroccan targets listed in data obtained years earlier by Forbidden Stories and Amnesty International, though not every number may have been compromised. Some entries likely served as tests for vulnerabilities while active surveillance rotated to manage costs.

The money trail behind Morocco's purchases stays unclear, as does the source of funding.

Codename Morgan

Hulio's name surfaces again in another document obtained by Esquivel that highlights NSO's ties to Israel. Upon landing in Panama on December 3, 2013, the co-founder used an Israeli diplomatic passport per immigration records and indicated he would stay at the Israeli Embassy in Panama City.

Such privileges prompt questions since Hulio's name is absent from the official diplomatic passport list released that year by Israel's Ministry of Foreign Affairs. Tel Aviv reserves these passports for senior officials, emissaries abroad, Knesset members and those on national security assignments. Hulio has denied ever holding one despite multiple queries.

Israeli authorities have extended other courtesies to NSO. A 2024 data leak from the Ministry of Justice shared by DDoSecrets showed steps taken to shield the firm. In summer 2020 amid a WhatsApp lawsuit the government preemptively seized documents from NSO offices citing potential state secrets.

NSO executives remain guarded with foreign courts. Before a French judge on January 29, 2026, in a Pegasus victim case, Hulio declined to answer eleven times citing Israeli law. He stayed silent on client countries and when asked specifically about Morocco he repeated the legal reference before noting that Morocco had denied any purchase.

Evidence continues to accumulate. Industry sources confirm Morocco's NSO codename is Morgan, following the pattern of aliases that start with a country's initial letter and reference car brands. The name also appears in NSO documents released during a US lawsuit.

"Bullshit!"

A former NSO staffer laughed off Moroccan denials over Pegasus use. An associate of NSO president Shiri Dolev added that management maintained contact with the Moroccan client even after the Pegasus Project reports surfaced.

A December 26, 2022 memo from France's Directorate-General for External Security, now in court files, states French intelligence knows of 38 Pegasus buyers. The document, first reported by Mediapart, notes that the UAE and Morocco have used NSO tools since at least 2017, linking the two in one sentence and supporting the partnership theory. It further assesses that NSO and possibly Israel likely know the targeted phones and extracted data, implying few secrets exist among the three parties.

After the Pegasus Project revelations the group altered its approach. Morocco's latest Pegasus traces end in November 2021 per Amnesty International's Security Lab. Israel tightened export rules for spyware. For Safir the period feels over. "In 2022 other firms pitched products to the DGST amid rumors NSO had exited," he said, comparing it to the 2017 Hacking Team situation. FSSYS Maroc reportedly introduced new vendors including one started by two ex-NSO employees. Rules changed yet familiar faces remained.

Morocco, Israel, the UAE, the DGST and Etimad/Edge offered no responses.

*Name changed for privacy.