Discovery of ‘sophisticated’ gadget adds to company’s list of privacy concerns after hackings by rogue agents