Citizen Lab says investigation found that at least 65 individuals were targeted with software sold by two NSO Group and Candiru