- Temps de lecture : 5 min.
While France was considering buying Pegasus, Morocco was spying on its ministers
For months, France considered acquiring the world’s most infamous spyware. New documents reviewed by Forbidden Stories detail the internal plans, drawn up at the very same time Morocco appears to have been secretly targeting members of the government with Pegasus. The Élysée Palace ultimately vetoed the purchase in a sudden reversal of course.
Credit: Mélody da Fonseca
- In a hearing reviewed by Forbidden Stories, NSO’s official reseller in France reveals the details of his meetings with intelligence agencies, referencing a price of “60 to 80 million” euros for the purchase of the software.
- The Élysée Palace ultimately backed down at the end of 2020 due to reputational risks and concerns over compromising sovereignty.
- The application for authorization to sell Pegasus in France was resubmitted to the Cybersecurity Agency after the presidency vetoed the acquisition of the software.
- Seven phones belonging to ministers at the time show “signs of compromise” by Pegasus, similar to those found on the devices of targets previously linked to Morocco.
By Eloïse Layan, Hicham Mansouri and Guillaume Vénétitay
July 16th 2026
Even warrior monks have secrets. Sébastien Lecornu opted for the term “vassal” himself, pledging his loyalty to Emmanuel Macron when he was appointed prime minister. The expression carries an ascetic, even dull connotation.
Yet there is one country that has taken an interest in Lecornu’s life and work: Morocco. In July 2019, while the Normandy native was still the minister of local authorities, the Kingdom of Morocco reportedly targeted his phone with the Pegasus spyware, sold by the Israeli company NSO.
Sébastien Lecornu at École Polytechnique in October 2022 (Credit: École Polytechnique / J. Barande / CC BY-SA 2.0).
The former mayor of Vernon is clearly not holding a grudge. Neither is France. Lecornu is traveling to Rabat on July 15 and 16, accompanied by 12 ministers for a “high-level meeting” intended to cement the reconciliation between France and Morocco. This comes just as Forbidden Stories and its partners are publishing new revelations about Morocco’s mass surveillance operations, particularly regarding the infiltration of seven French ministers’ phones in 2019 and 2020 with the Pegasus spyware.
New documents, which the consortium was able to review, tell an even more staggering story: that France considered acquiring Pegasus for many months, even as the country’s highest-ranking officials were already among its unknowing victims.
“60 to 80 million euros” for Pegasus
There’s no need to travel all the way to NSO’s headquarters in Herzliya, 10 kilometers north of Tel Aviv, to understand how the French government was tempted to acquire Pegasus. A visit to Angoulême, Charente, will suffice. This is where 52-year-old Jérôme S. lives, in a house tucked away on a quiet street. He heads Syans, a company with five employees in 2022, which has been providing services to French intelligence agencies — including the General Directorate for Internal Security, or DGSI — “for years.” Syans is also NSO’s exclusive reseller in France.
Investigators interviewed Jérôme as part of the probe launched in France following complaints from Pegasus victims. During his interview, which the consortium reviewed, he revealed a number of features tailored for France as a potential customer. In particular, it was reportedly planned that the malware would have a limited lifespan and self-destruct to avoid detection if the phone were analyzed. In another indication that the discussions were advanced, Jérôme mentioned his commission in the event of a Pegasus sale — 50,000 to 65,000 euros — and even a specific cost estimate for the transaction: “I think that as far as France is concerned, the price proposed by the NSO Group is around 60 to 80 million euros.” When contacted, Jérôme declined to comment to protect his business.
“Several government agencies were pushing for Pegasus”
Around the turn of 2020, the DGSI and Directorate of Military Intelligence were noted as possible Pegasus clients, according to documents Forbidden Stories reviewed. The spyware also caught the attention of the Ministry of Justice, which considered its potential as a tool in investigations related to drug trafficking or terrorism. “Several government agencies were pushing for Pegasus, including the Ministry of Justice,” confirmed a member of French intelligence. There is no indication that the software’s intended uses in France were illegal.
Some have explicitly expressed their enthusiasm for such technology. Take Jean-Dominique Nollet, a graduate of the Special Military School of Saint-Cyr, who spent his career first in the army and then in the Gendarmerie. A man with thin-framed glasses, he met with NSO in Prague “around 2016 to 2017” and later at the company’s headquarters while he was on secondment to Europol, the European Union’s criminal police agency.
At Europol, “we were all extremely impressed by the tool’s performance, both in terms of deployment and data collection. … By providing the phone number, NSO could infect the phone in about 20 seconds,” said Nollet — who is now employed by TotalEnergies — during his interview with investigators. In Herzliya, he could hardly contain his fascination with “a room of about 15 square meters filled with every type of iOS and Android phone on the planet, which were continuously subjected to tests for infection and malware deployment.”
Traces of Morocco in the case of hacked French ministers
As the ministries scrambled, they were unaware that they’d been outmaneuvered. On the other side of the Mediterranean, Morocco had been using Pegasus since late 2017. Responding to a court order dated Nov. 8, 2022, the General Directorate of External Services, or DGSE, “confirms that the United Arab Emirates and Morocco have been using NSO products since at least 2017” — an allegation the Kingdom has always denied. The revelations from the Pegasus Project in the summer of 2021 sent shockwaves through the public: Phone numbers belonging to Macron and 15 members of the government were found on Morocco’s list of potential targets. “I was never informed of the results of the analysis of Macron’s phone; that was handled directly by the Élysée Palace, with the utmost confidentiality,” said a senior French intelligence official.
In line with the high degree of confidentiality surrounding the head of state, nothing has leaked out about the possible hack of his smartphone. However, new evidence reviewed by the consortium confirms “traces of compromise” by Pegasus on the phones of seven members of the government at the time: Jean-Michel Blanquer, Jacqueline Gourault, Julien Denormandie, Emmanuelle Wargon, François de Rugy, Florence Parly and Lecornu.
These traces are all linked to Morocco. In Lecornu’s iPhone XS, the Cybersecurity Agency identified two markers indicating the presence of the addresses “bergers.o79@gmail.com” and “bogaardlisa803@gmail.com,” detected in cache files used by Apple. Parly’s iPhone 12 also contained traces of “bergers.o79,” as well as a second email address, “naomiwerff772@gmail.com.” Each is known to have been used against targets of interest to the Kingdom of Morocco — “bergers.o79” notably compromised journalist Omar Radi’s phone, according to evidence from Amnesty International’s Security Lab. The signs of infiltration for Lecornu and Blanquer extend all the way to March 2020 — that is, after the most recent targeting dates revealed by the Pegasus Project.
For its part, the DGSE stated in a letter dated April 20, 2022, that based on its analysis, it is “able to link certain intrusions to the intelligence activities of countries that are Pegasus clients and believes that they are part of espionage operations that undermine the nation’s fundamental interests.”
Secrecy and embarrassment at the Élysée
The legal proceedings that followed Forbidden Stories’ revelations also showcase a certain indifference on the part of officials caught up in a possible hack. The testimony of Parly, former minister of the armed forces, was a string of “I don’t remember” responses. She claimed to have “no suspicion regarding which agency or government might have been behind (the) targeting.” The minister also did not recall the details of her meeting with Benny Gantz, the Israeli minister of defense, who, according to NSO co-founder Shalev Hulio, handed her a report certifying that no French political figure had been targeted by Pegasus.
These memory lapses and omissions illustrate the embarrassment at the highest levels. France, moreover, is quite happy not to be implicated in the Israeli software. As proof, the Élysée Palace was quicker to announce its refusal to purchase Pegasus than to disclose the results of the analysis of Macron’s phone. The decision had been made in late 2020, as Le Monde revealed. “Emmanuel Macron announced it during a defense council meeting and cited reasons of sovereignty as well as reputational risk, noting that the spyware was already being used by authoritarian regimes,” a source familiar with the matter confirmed to Forbidden Stories.
But confusion remains. Six months after the Élysée’s veto in June 2021, Jérôme, the spyware distributor in France, filed an R226 application — the procedure for selling surveillance or interception technologies — on behalf of Syans, noting that “the DGSI wanted to acquire the software.” By his account, the budget had been “approved at the ministerial level,” and the project had even received the government’s “green light” by the end of 2020. Why was the application for authorization to sell Pegasus in France submitted at that time? Was this a power play by the intelligence community? The director of the National Technical Service for Judicial Surveillance, which reports to the DGSI, believes that NSO’s representative in Europe, Dutch national Rogier R., acted on his own, acknowledging France’s refusal while simultaneously making “arrangements to resubmit a proposal to the R226 committee.”
This adds yet another layer of mystery for investigators, who have been unable to count on Morocco’s cooperation, as the country refused to issue a letter rogatory, according to the magistrates. Ahead of this week’s ministerial visit, King Mohammed VI sent his warmest regards to Macron in a spirit of “friendship, trust and high standards,” according to media loyal to the Kingdom. As for Lecornu, he will attend a luncheon “hosted” by the king this Thursday.
In May 2019, Gérard Araud spent 48 hours visiting NSO’s offices at the invitation of the American investment fund Novalpina, which had acquired the Israeli company. The recently retired civil servant — whose last post was as French ambassador to the United States — noted that “the employees of this company are all very young, dressed casually in shorts and T-shirts.” During his testimony, he also stated that he quickly had “doubts” about the “curious” consulting assignment he was offered. “In fact, I had a hunch that the NSO tool might have what I’ll call a ‘backdoor’ to the Mossad,” he said.
That didn’t stop him from ultimately accepting a position as ethics advisor from September 2019 to September 2020, against the advice of “his friend” Bernard Emié, then director of the DGSE. It should be noted that in Araud’s circle of acquaintances, “his best friend,” Zamir Dabbash, is the head of Novalpina. “NSO needed to project a more respectable image following a scandal over the use of its software in Mexico against journalists,” Araud explained awkwardly, fully aware of the image-polishing operation in which he was participating. In the end, he told the investigators that he “isn’t unhappy to be getting out of this” and that he “found (he was) paid for doing nothing much.” A bit of lucidity, after all.