Mossos forensic report confirms Pegasus spyware infected Puigdemont aide's phone
A Mossos d'Esquadra forensic report presented to a Barcelona court confirmed that Josep Lluís Alay, chief of staff to former Catalan president Carles Puigdemont, was infected with Pegasus spyware starting in October 2019. The infection occurred while Fernando Grande-Marlaska served as Spain's Interior Minister, and the report indicates at least 3.2 gigabytes of data were extracted from the device.
What happened
A Mossos d'Esquadra forensic report presented to Barcelona's Juzgado de Instrucción 4 confirmed that an iPhone 8 belonging to Josep Lluís Alay, chief of staff to former Catalan president Carles Puigdemont, was infected with Pegasus spyware from 11 October 2019 until at least 25 June 2020, with a second infection period starting 29 June 2020.
Alay received approximately ten malicious text messages containing links to domains associated with Pegasus indicators of compromise, including a fake notification impersonating Human Rights Watch regarding a humanitarian operation in Syria. He clicked on one message, which initiated the first infection at 1:30 p.m., approximately five minutes after he had read the notification.
The report, dated October 2024, concluded that at least 3.2 gigabytes of data were extracted and sent via internet to an unknown destination from Alay's device. On a second Redmi Go (Xiaomi) phone, one malicious text message was detected but not read.
Reported impact
The infection began on 11 October 2019, shortly before the Catalan independence trial verdict and during Fernando Grande-Marlaska's tenure as Interior Minister in Pedro Sánchez's government.
Governance controls
NSO Group states that Pegasus is used exclusively by government agencies to combat organized crime and terrorism.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.