Former Moroccan Intelligence Chief Linked to Massive Leak of 70,000 Security Agents
Former Moroccan intelligence official Mehdi Hijjaoui is suspected of leaking the details of over 70,000 security personnel and holding sensitive data on the Pegasus spying scandal targeting Spanish PM Pedro Sánchez.
A former high-ranking Moroccan intelligence official, once considered a rising star within the kingdom's security apparatus, has allegedly become one of the greatest threats to the monarchy. Spanish newspaper ABC revealed on Monday that Mehdi Hijjaoui, a former senior figure in Morocco's foreign intelligence service, is suspected of being the mastermind behind the massive leak of personal details belonging to over 70,000 Moroccan security personnel.
Hijjaoui, who previously served as the number two official in Morocco's foreign intelligence agency, the Direction Générale des Études et de la Documentation (DGED), was for years regarded as the "golden boy" of Moroccan intelligence. He climbed to the top of the DGED, becoming one of its most prominent figures until he was ousted in 2014 amid power struggles between the foreign intelligence service and domestic security agencies. Following his dismissal, he served as a direct advisor to Fouad Ali El Himma, the senior advisor to King Mohammed VI and one of the most powerful figures in Morocco.
Escalation and Escape
Relations between Hijjaoui and the regime gradually deteriorated. He became the target of a state-sponsored campaign that included defamation, legal actions against approximately 20 people in his circle, and harassment of his family. The conflict escalated sharply after Hijjaoui published a document detailing secrets from the royal court—a move perceived as a declaration of war against his rivals within the intelligence and political establishment.
In 2024, after his wife and infant daughter were targeted, Hijjaoui fled Morocco. He did not leave empty-handed, taking sensitive documents and state secrets accumulated during his years at the pinnacle of the intelligence apparatus. He initially arrived in France, while Morocco issued an international arrest warrant against him on charges of fraud, embezzlement, and document forgery.
Hijjaoui later traveled to Spain, where he was arrested and brought before the National Court as part of extradition proceedings initiated by Morocco. The court decided not to detain him but confiscated his passport. Despite subsequent attempts to persuade him to return to Morocco voluntarily, he managed to escape Spain days later.
His escape resembled a professional intelligence operation. Assisted by former collaborators of Spanish intelligence, Hijjaoui left Spain under a false identity using a route that involved a boat and a private jet. He reached Turkey and subsequently moved to an undisclosed location. Currently subject to an Interpol red notice, associates told ABC that he is outside Europe and frequently changes locations due to threats to his life.
The Massive Intelligence Leak
The manhunt has taken on a new dimension. According to ABC, Hijjaoui's associates confirmed that he provided the data leaked last month by the hacker group "Jabaroot," which exposed the personal details of 70,381 Moroccan security personnel. The leak targeted members of the domestic security agency, the Direction Générale de la Surveillance du Territoire (DGST), and the national police (DGSN). Spanish media described it as one of the most severe security breaches in Moroccan history.
European intelligence services are currently analyzing the leaked data. Preliminary assessments indicate that the names on the lists are authentic and some are known to European agencies, though some information may be outdated. The documents also include materials concerning the operations of Moroccan security forces near the Spanish enclave of Ceuta during a mass migration event in July. "Jabaroot" has threatened to release additional documents proving the involvement of Moroccan state officials in these events.
The Pegasus Connection
The most sensitive information Hijjaoui may possess relates to the "Pegasus" espionage scandal. Spanish publications have identified him as the alleged "technical architect" of the spying operation against Spain using the Pegasus spyware developed by the Israeli cyber firm NSO Group. The operation targeted the mobile phone of Spanish Prime Minister Pedro Sánchez and other high-ranking officials. Morocco has consistently denied involvement in the spying campaign.
Suspicion that "Jabaroot" holds materials related to the Pegasus scandal intensified after the group posted a question on its Telegram channel:
"Who is interested in Pegasus information on Pedro Sánchez?"
While there is currently no public evidence that the group possesses data extracted from Sánchez's device, experts believe Hijjaoui holds materials obtained from phones compromised by the spyware.
This remains a primary reason why Rabat is determined to locate him. Sources speaking to ABC stated that Hijjaoui possesses highly sensitive information not only regarding Moroccan intelligence operations but also concerning King Mohammed VI and alleged corruption scandals involving senior officials. These sources described him as a "tangible threat" to the King.
According to reports, Hijjaoui's objective is not to harm Spain, but to use the information to destabilize the Moroccan regime and accelerate a transition of power. Consequently, the former intelligence chief has become the kingdom's most wanted fugitive, carrying some of its most sensitive state secrets.
