Intrusions believed to have taken place in 2019 and 2020; separately, Israeli-made spyware confirmed on phone of UAE human rights activist