From product demonstrations at a secret villa in Rabat to training sessions at NSO’s Herzliya headquarters, Forbidden Stories and its partners retrace the early stages of Morocco’s use of Pegasus.
This technical analysis provides the most detailed view yet into the inner workings of the Pegasus spyware system. This includes confirmation of key technical capabilities such as the infection vectors and methodologies used to infect devices, supported by analysis of internal NSO Group documents, that until now had only been identified via forensic investigations. It also presents new material further validating the accuracy and significance of the dataset underpinning the original Pegasus Project investigation. Finally, this research provides an updated analysis, drawing on previously published Pegasus forensic evidence and newly released materials, to validate the technical methodology used to forensically link Pegasus spyware attacks targeting different victims as originating from the same Pegasus customer.
Trailing targets, monitoring internet cafes, deploying spyware: Morocco has mobilized a massive arsenal of surveillance tools against journalists and dissidents in recent years.
However, new evidence reviewed by the consortium confirms “traces of compromise” by Pegasus on the phones of seven members of the government at the time: Jean-Michel Blanquer, Jacqueline Gourault, Julien Denormandie, Emmanuelle Wargon, François de Rugy, Florence Parly and Lecornu.
The minister also did not recall the details of her meeting with Benny Gantz, the Israeli minister of defense, who, according to NSO co-founder Shalev Hulio, handed her a report certifying that no French political figure had been targeted by Pegasus.
The Government is expected to share further information on VPNs in July, after an update from Technology Secretary Liz Kendall.
Large-scale datacentre projects around the world are being challenged or cancelled, as infrastructure’s energy demands ramp up
The company’s total electricity consumption jumped from 31 terawatt hours (TWh) in 2024 to 43 TWh in 2025. This is very easily the biggest increase in their electricity consumption ever, and it puts them way ahead of Microsoft. It is almost certainly a reflection of the obscene energy hunger of their ever-expanding bloated generative AI systems, and a vindication of the warnings we’ve been raising for several years now.
We found that former Member of the European Parliament Stelios Kouloglou was hacked with Pegasus spyware while serving on the PEGA committee, which investigated Pegasus and other spyware abuses in Europe. Through forensic analysis of his device, we found that the attackers could have had access to confidential documents and committee deliberations.
WhatsApp caught and disrupted spear phishing attempts linked to NSO, a spyware firm blacklisted by the US government.
A new hacking campaign is trying to trick Signal users to give up their secret recovery key, which can be used to access online backups containing past messages.
Behind the curtain of Xi’s vast police state, Big Brother is watching ‘enemies of the people’ – including The Telegraph’s Sophia Yan
New analysis confirms the targeted applications and reveals fast16 was tailored to corrupt uranium-compression simulations central to nuclear weapon design.
Google has today announced the launch of a new ‘Android Intrusion Logging’ feature as part of Android Advanced Protection Mode (AAPM). The new intrusion logging feature promises to be a major aid to digital forensics researchers undertaking investigations into sophisticated attacks on Android devices. This is the first time a major device vendor has release a feature specifically to enhance the ability to forensically detect and respond to advanced digital threats.
The Barcelona High Court reopens the investigation into Pegasus espionage against three Òmnium members, requesting information from the CNI.
Alice says the video was posted on social media and viewed about 40,000 times.
Our official statement to the digital rights community about why RightsCon 2026 will not take place in Zambia
After a global Pegasus spyware scandal, El Salvador’s presidential office quietly pursued a new spyware deal through intermediaries.
The first quarter of 2026 saw a surge in Internet disruptions, from nationwide shutdowns in Uganda and Iran to unprecedented drone strikes on cloud infrastructure. We explore the data behind these events using Cloudflare Radar.
Despite promising to help determine what happened with the hacks targeting journalists and activists in Italy, Israeli American spyware maker Paragon has reportedly not responded to authorities’ requests for information.
In collaboration with the International Consortium of Investigative Journalists (ICIJ), we identified what we conclude to be two distinct actors aligned with the People’s Republic of China. Our findings provide insight into the Chinese government’s practice of digital transnational repression and its shift to a system of state-sponsored attacks carried out by private contractors.