The attackers were targeting journalists and activists, as well as government officials, military personnel, financial institutions, defense contractors and others in 21 countries. Those countries included the United States, China, Germany, India, Russia, Saudi Arabia, South Korea and inside Lebanon.

The researchers traced the attacks to a building in Beirut that houses Lebanon’s GDGS, using Wi-Fi networks and so-called internet protocol addresses assigned to attackers’ machines. While researchers said they could not be sure whether the attacks were the work of the GDGS or rogue employees, many of the attacks appeared tied to an email address — op13@mail.com — that had been linked to various online personas, including “Nancy Razzouk” and “Rami Jabbour.” All of the physical addresses listed with registrations made by that email account were clustered around the GDGS building in Beirut, according to the user’s wireless activity.

Emails sent to that email address were not returned.

As part of their work, researchers found evidence that Lebanese spies were directing victims to install the spy apps through WhatsApp messages that began innocuously with a “How are you?” Those then linked to the spy apps with additional messages like “You can download from here to communicate further.”

In other cases, the spies found their targets on Facebook, inviting them to Facebook groups, where they posted links to their decoy apps, which they often referred to by names like “WhatsApp plus.” The spies also directed victims to fake login sites for social media services like Twitter and Facebook to steal their credentials, hijack their accounts and push out trick messages to more people.

Researchers also found evidence that Lebanese officials had previously used FinFisher, a product manufactured by the British company Gamma International, which sells surveillance tools that let customers turn computers and phones into listening devices to monitor a target’s messages, calls and whereabouts. Increasingly, researchers discovered that the spies had built their own custom mobile spy tools that were less sophisticated than FinFisher but as effective in getting the intelligence they were after.

Martin J. Muench, the managing director of Gamma International, has told The New York Times that his company only sells surveillance tools to governments for criminal and terrorism investigations. The Times has covered several instances in which Mr. Muench’s tools have popped up on devices used by journalists and activists. Gamma Group did not respond to a request for comment on Thursday.