Citizen Lab uncovers the first technical evidence of a 'zero-click mercenary spyware' attack circulating via online ads to hit mobile phones.