Spain's top spymaster was grilled behind closed doors by lawmakers on Thursday over mobile phone hacking revelations that have roiled the country's fragile coalition government.

Paz Esteban, the first woman to head Spain's CNI intelligence agency, appeared before a parliamentary committee for questioning over the affair which has dominated headlines for days.

The scandal broke last month when Canadian cybersecurity watchdog Citizen Lab said the phones of over 60 people linked to the Catalan separatist movement had been tapped using Pegasus spyware after a failed independence bid in 2017.

Catalan separatists immediately pointed the finger at the CNI and threatened to withdraw their support for Socialist Prime Minister Pedro Sanchez's minority government unless heads roll.

Sanchez's government depends on Catalan separatist party ERC to pass legislation and remain in power until the next general election due in late 2023.

On Monday, the government announced that the phones of Sanchez and Defence Minister Margarita Robles, whose ministry oversees the CNI, were hacked last year by the same spyware made by Israel's NSO group.

The revelation raised questions over who is to blame and whether Spain has adequate security protocols.

Asked if Esteban, who has headed the CNI since 2020, will remain in her post, government spokeswoman Isabel Rodriguez said Tuesday she did not want to "talk of future scenarios".

Catalan separatists and hard-left party Podemos, Sanchez's junior coalition partners, demand that the defence minister resign over the affair.

Some Spanish media have pointed the finger at Morocco, which was in a diplomatic spat with Spain at the time, but the government has said it was no evidence of who may be responsible.

Pegasus spyware infiltrates mobile phones to extract data or activate a camera or microphone to spy on their owners.

The Israel-based NSO Group, which owns Pegasus, claims the software is only sold to government agencies to target criminals and terrorists, with the green light of Israeli authorities.

The company has been criticised by global rights groups for violating users' privacy around the world and it faces lawsuits from major tech firms such as Apple and Microsoft.