The hacker collective Jabaroot has escalated its digital offensive against Morocco, this time turning its attention to the Spanish Prime Minister’s shady dealings in what could quickly prove also to include sensitive Moroccan secrets.
After leaking on 24 August what they claim are personal data on 70,381 agents affiliated with Moroccan intelligence and police, the group posed an open question on Telegram: “¿A quién le interesan los datos originales de Pegasus relacionados con Pedro Sánchez?” (“Who is interested in the original Pegasus data related to Pedro Sánchez?”).
The message was interpreted as a threat and/or an offer to release the material “within a short time”.
The Pegasus spyware
In 2021, Pedro Sánchez’s mobile phone was infected with the Pegasus spyware developed by the Israeli company NSO Group. Spanish authorities have subsequently confirmed that at least 2.57 gigabytes of data were extracted in May 2021 and further amounts in a later infection. The contents – messages, documents, photographs and other sensitive information – have never been made public.
The investigation was closed several times, partly because of reluctant cooperation from Israel. Observers, including the European Parliament, have pointed to Morocco as a possible client, something Rabat has consistently denied.
Jabaroot, whose history is marked by leaks of data obtained from Moroccan institutions, explicitly links the threat to the Ceuta crisis and the growing tension between Spain and Morocco. They presented the major leak of agents’ data as “a gift to Europe, especially Spain”, and are following it up by reopening the most sensitive chapter in Spanish intelligence history in recent years.
¿QUIÉN ES JABAROOT? NI UN GRUPO RANDOM NI UN BULO DE TELEGRAM. DESDE ABRIL DE 2025 ACUMULA UN HISTORIAL QUE, FILTRACIÓN TRAS FILTRACIÓN, HA RESULTADO SER VERDAD.
Primera filtración: la nómina completa de 3.400 empleados de los palacios reales de Marruecos. Rabat nunca dijo que… pic.twitter.com/tN9MtDFZ3x
— 𝗗𝗼𝗻 𝗘𝘂𝗴𝗲𝗻𝗶𝗼 🇪🇸 (@EugenioValle64) August 25, 2026
It has so far not been verified that Jabaroot actually possesses original files from Sánchez’s phone. Commentators warn of a combination of propaganda, reuse of previously leaked data and strategic pressure against Sánchez – and also against Morocco.
Should it prove that Morocco was the client behind the Pegasus tapping of Sánchez’s phone, this opens up a number of interesting perspectives: Sánchez, as head of the Spanish government, has sent enormous sums to Morocco. Can this be characterised as protection money; has Islamic Morocco taken possession of Sánchez’s skeletons in the cupboard; on what principles is Morocco’s foreign policy conducted – and what about Spain’s?
– Having a president who has been hacked means that state secrets are in foreign hands and that the country has for years been governed under threat. What is Sánchez hiding in these files, is he protecting himself at the expense of the interests of all Spaniards? The government’s silence confirms the seriousness of the situation; we are weakening ourselves as a nation.
The security of our homeland cannot be held privately hostage by a president who has been backed into a corner. If the Pegasus data come to light, it will be proven that Spain has been governed under blackmail by a government that preferred to submit and relinquish national sovereignty rather than tell the truth, writes political analyst Miguel Pader:
🚨 CHANTAJE A ESPAÑA: LA SOMBRA DE PEGASUS DEJA AL DESCUBIERTO LOS SECRETOS DE SÁNCHEZ 🇪🇸
El anuncio del colectivo Jabaroot sobre la publicación de los datos robados del móvil de Pedro Sánchez confirma el escenario más temido.
No es un simple problema informático, sino un… pic.twitter.com/tOa0R3s1bS— Miguel Pader 🇪🇸 (@MPSnoserinde) August 25, 2026
– Jabaroot has stated that they are in possession of information extracted from Pedro Sánchez’s mobile phone using Pegasus. This could obviously mean the end for Pedro Sánchez. Could this be the reason for Sánchez’s complete absence and inability to do anything whatsoever, and why (Transport Minister) Oscar Puente, to everyone’s surprise, declared Sánchez dead the day before yesterday and positioned himself as his successor? Jabaroot has so far carried out all its threats, so we may be facing Pedro Sánchez’s most difficult days, writes Un Abogado Controla la Demagogia:
⚠️TERREMOTO EN ESPAÑA⚠️
Los hackers Jabaroot que acaban de filtrar los datos de 70.381 espías de Marruecos, cumpliendo su amenaza, han informado que ya tienen en su poder información de los 2.57 Gb del móvil de Pedro Sánchez hackeados en mayo de 2021 a través de Pegasus.
Esta… pic.twitter.com/4vDcMPL6Wq— UN ABOGADO CONTRA LA DEMAGOGIA (@UACD_Youtube) August 25, 2026
The socialist Oscar Puente attracted attention in July 2025 for online comments referring to French Jewish students as “Israeli brats” after they were controversially removed from a Spanish flight.
They do not merely promise, they also deliver
At present, we are faced with a threat that has not been carried out. But Jabaroot has shown several times that they can deliver. These are exciting times.
Hacker collective Jabaroot delivers: Publishes data on 70,000 Moroccan intelligence agents
