Last summer, Dr. Simón Barquera’s phone started buzzing with a series of disturbing text messages from unknown numbers. One said his daughter had been in a serious accident. Another claimed to be from a friend whose father had died — with a link to funeral details.
Yet another message informed Dr. Barquera, the director of nutrition policy at Mexico’s National Institute of Public Health, that a Mexican news outlet had accused him of negligence, again with a link. And in more menacing messages, someone claimed to be sleeping with Dr. Barquera’s wife. That included a link to what the sender claimed was photo evidence of their affair.
That same week, Luis Manuel Encarnación, then the director at Fundación Mídete, a foundation in Mexico City that battles obesity, also started receiving strange messages with links. When he clicked, Mr. Encarnación was ominously redirected to Gayosso, Mexico’s largest funeral service.
The messages Mr. Encarnación received were identical to a series of texts sent to Alejandro Calvillo, a mild-mannered activist and founder of El Poder del Consumidor, yet another Mexico City organization that has been at the forefront of battling childhood obesity in the country.
What the men had in common was this: All were vocal proponents of Mexico’s 2014 soda tax, the first national soda tax of its kind. It is aimed at reducing consumption of sugary drinks in Mexico, where weight-related diseases kill more people every year than violent crime.
The links sent to the men were laced with an invasive form of spyware developed by NSO Group, an Israeli cyberarms dealer that sells its digital spy tools exclusively to governments and that has contracts with multiple agencies inside Mexico, according to company emails leaked to The New York Times last year.