Data leak and forensics suggest NSO's surveillance tool used against journalists at some of world's top media companies