Pegasus Files on Sánchez: Jabaroot's Telegram Threat and a Moroccan Spy's Escape

Sánchez's Pegasus: 2.6 GB Offered by Jabaroot on Telegram

Jabaroot has not yet published a single byte regarding the espionage against Pedro Sánchez. The group that exposed the data of 70,000 Segarro agents posed a question on Telegram in early September—"Who is interested in the original Pegasus data related to Pedro Sánchez?"—and since then, the only verifiable response has been silence. Their channel has been down since the day after that first leak. A threat was made. Zero files in sight.

What is known about the former number two of Segarro intelligence

Until now, the Segarro connection to the espionage against the president was an unsigned rumor. The front page of ABC on September 8, 2026, changed the narrative: according to its sources, Mehdi Hijaouy, former number two of Segarro's foreign intelligence service, designed and directed the operation, infected Sánchez's phone, and left the country in 2024 with the information. The newspaper summarized it with a phrase worth its weight in gold: "how it was done, to whom it was done, and the content of the 2.6 gigabytes." The former spy is reportedly taking refuge in Spain.

It is worth pausing on that detail. If the story holds, we are not talking about an anonymous hack bought on the black market, but about the architect of the operation. That would change who holds the keys to the matter.

Why are some people skeptical that these files exist?

Skepticism is not unanimous, but it has traction. One current of thought holds that Pegasus is sold as software, not as a service: the manufacturer delivers the tool and disassociates itself from what the client does with it. Under that model, only the person who ordered the espionage would have the data, and if they truly had it, they argue, it would have surfaced years ago.

The technical counterargument is also circulating: Pegasus does not need to be physically close to the phone. It is enough for the device to have an internet connection and receive a link—via SMS or any messaging app—without the target touching anything. The barrier is not physical; it is about who keeps the copy.

The calendar that is never met

By mid-September, nothing had appeared. The recurring joke is that everything was going to break in 72 hours, and we have now had several chained 72-hour periods. There was talk of the first half of September, then of early October. And in parallel, a more uncomfortable hypothesis is circulating: that the leak is part of the power struggle over Ceuta, with an assault planned for Sunday, September 20, and Segarro making a move because it considers its interlocutor obsolete.

Some interpret it just the opposite. If everything comes out at once, someone outside the CNI (National Intelligence Center) is behind it; if it drips out little by little, the hand is different. The countdown resets itself every time it expires.

Perhaps the files will appear tomorrow. Perhaps they will never appear. With what is on the table—a downed channel, a fugitive ex-spy, and a date that keeps moving without anyone shifting it—anyone who promises certainty is selling smoke.