Cyber Incident Victim: Abdessadak El Bouchattaoui
Date:
Oct 2017
Location:
Morocco
Summary
A Moroccan human rights lawyer involved in defending protesters from the Hirak El-Rif social justice movement was targeted with NSO Group's Pegasus spyware through malicious SMS links sent during the peak of the protests and subsequent government crackdown. The digital attacks, consistent with broader state reprisals against activists, aimed to compromise mobile devices to install surveillance tools, unlawfully infringing on privacy and freedom of expression. These tactics contributed to shrinking civic space by intimidating human rights defenders through invasive monitoring.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 2 motives | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
Abdessadak El Bouchattaoui, a Moroccan human rights lawyer, was targeted with digital surveillance attacks involving NSO Group’s Pegasus spyware during his legal defense work related to the Hirak El-Rif protests. The attacks occurred around 2017, coinciding with the peak of the social justice movement and subsequent government repression. Amnesty International’s forensic analysis revealed that El Bouchattaoui received malicious SMS messages containing links to websites associated with Pegasus spyware. These messages were designed to exploit mobile devices upon interaction, enabling unauthorized installation of surveillance software that could extract communications, location data, and other sensitive information. The targeting aligned with his role representing individuals imprisoned for participating in the 2016-2017 protests, which challenged socioeconomic inequalities and corruption in Morocco’s Rif region.
The digital attacks formed part of a broader pattern of state-sponsored reprisals against human rights defenders in Morocco. Amnesty International documented similar targeting of activist Maati Monjib, with evidence suggesting network injection attacks complemented SMS-based delivery methods. While forensic evidence confirmed Monjib’s device compromise, El Bouchattaoui’s infection status remained unverified due to insufficient technical data. The surveillance campaign violated international human rights standards by unlawfully interfering with privacy and freedom of expression. Amnesty International publicly exposed these operations in October 2019, highlighting NSO Group’s role in facilitating state abuses despite its claims of lawful use. The organization established a reporting mechanism for potential victims while condemning Morocco’s use of spyware alongside legal harassment to suppress dissent.