For the first time, investigators have traced spyware to its physical origin—revealing new types of duplicity