On Twitter, it was billed as Qatif Today, a legitimate Android app that provides news and information in Arabic with a focus on the Qatif governorate of Saudi Arabia. But in fact, the shortened link came with a hidden extra — an advanced trojan wealthy nation states use to spy on criminal suspects and political dissidents.