Spyware once used by governments is now spreading to cybercriminals