Journalists, human rights activists, anti-corruption campaigners, opposition politicians and now international investigators...
Journalists, human rights activists, anti-corruption campaigners, opposition politicians and now international investigators probing the alleged massacre of 43 students: all have been targeted with a government spyware called Pegasus, according to computer security researchers.
Here's what we know -- and don't -- about the snowballing scandal:
Developed by a super-secretive Israeli company called NSO Group, Pegasus gives total access to targets' smartphones -- including the ability to eavesdrop on them using the camera and microphone.
It basically turns a target's phone into "a spy in your pocket," said John Scott-Railton, senior researcher at the Citizen Lab, a research group at the University of Toronto.
The spyware, which is sold only to governments, is meant to be used to target criminals and terrorists.
But in Mexico -- where the government has reportedly bought at least $80 million of spyware from NSO Group since 2011 -- the alleged spying went far beyond that.
The Citizen Lab's cybersecurity experts have confirmed at least 19 people were targeted.
First came advocates of Mexico's 2014 soda tax -- a measure opposed by commercial interests close to President Enrique Pena Nieto's government.
Since that emerged in February, the revelations have kept piling up: the targets include anti-corruption activist Juan Pardinas, opposition leader Ricardo Anaya, prominent investigative journalist Carmen Aristegui and even her teenage son.
This week came one of the most damaging reports yet: International experts investigating the disappearance of 43 students in 2014 -- an atrocity that still haunts Mexico -- were also targeted, even though they were supposed to have diplomatic immunity.
All the targets have something in common, said Scott-Railton: they are all "critics of the government and others who challenged the government's positions."
The targets received text messages prompting them to click on a link that would secretly install Pegasus on their phones.
The messages ranged from eye-catching headlines to funeral announcements to allegations of extra-marital affairs.
"You don't have the balls to watch how I get it on with your partner," said one message sent to journalist Rafael Cabrera.
"Two guys with guns are sitting in a truck outside your house. I took pictures of them -- take a look and be careful," said another sent to Pardinas.
Nine targets pressed charges against the government on June 19, accusing it of violating their privacy.
The government denies the charges and has ordered an investigation.
Scott-Railton said his team could not prove who was behind the spying.
But it was highly unlikely anyone but the government could have done it, he said.
"The software is served with a certain number of licensed infections.... It has both monitoring and infection infrastructure -- that's a lot of pieces that a lot of different parties have visibility on," he told AFP.
"We're confident that it is government-exclusive."
Targets have criticized the investigation by the attorney general's office -- which is itself one of the government agencies that purchased Pegasus.
Opposition lawmakers and others have urged an independent investigation.
But that looks unlikely.
"Experience shows that in this kind of case, where the government is implicated, the last thing it wants to do is advance the investigation," said political analyst Lorenzo Meyer, who told AFP the case shows the rule of law in Mexico is "theoretical, not real."
The scandal has been damaging for Pena Nieto -- whose popularity was already hovering around 20 percent -- at a time when his party, the long-dominant Institutional Revolutionary Party (PRI), risks losing power in elections next year.
But it is too early to say where the fallout will lead, said Samuel Gonzalez, former chief prosecutor for organized crime.
"We Mexicans have very short memories, and the investigation could last a very long time," he said.